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Detachable  Summary 

The  U.S.  energy  system  is  highly  vulnerable  to  large-scale  failures  with  catas¬ 
trophic  consequences,  and  is  becoming  more  so.  This  study  analyzes  the  origins 
of  that  vulnerability,  both  generically  and  specifically.  We  conclude  that 
America's  energy  insecurity  stems  from  the  nature,  organization,  control  struc¬ 
ture,  and  interconnections  of  highly  centralized  technologies.  These  technolo¬ 
gies — which  unfortunately  dominate  both  the  present  energy  system  and  current 
national  policy — cannot  withstand  terrorism,  sabotage,  enemy  attack,  natural 
disaster,  or  even  accidental  technical  failure.  The  resulting  brittleness  of 
energy  supplies  poses  a  grave  and  growing  threat  to  national  security,  life,  and 
liberty.  It  also  frustrates  the  efforts  of  our  Armed  Forces  to  defend  a  country 
whose  energy  supplies  can  be  turned  of  by  a  handful  of  people. 

Energy  is  more  than  oil,  and  energy  security  is  more  than  ability  to  keep  the  oil 
coming.  Although  current  inability  to  guarantee  oil  supplies  is  a  serious  prob¬ 
lem,  previous  analyses  of  energy  security  have  focused  all  but  exclusively  on 
oil,  and  have  therefore  diverted  attention  from  a  more  comprehensive  understanding 
of  how  to  achieve  energy  security.  Since,  moreover.  Federal  energy  planning  does 
not  consider  vulnerability  as  a  criterion,  many  policies  proposed  to  reduce  depen¬ 
dence  on  imported  oil  are  actually  mak'ng  energy  supplies  more  vulnerable  in  other 
and  even  less  tractable  ways.  Conversely,  opportunities  for  simultaneously  reduc¬ 
ing  oil  dependence  and  other  energy  vulnerabilities  are  being  ignored. 

This  analysis,  addressed  to  a  general  policy  audience  with  basic  numeracy,  and  to 
energy  and  preparedness  professionals,  seeks  systematically  to  identify  and  apply 
those  design  principles  that  can  make  America’s  energy  system  more  resilient,  less 
vulnerable,  less  susceptible  to  catastrophic  failures:  in  short,  to  make  the  nation 
better  prepared  for  all  kinds  of  disruptions,  whether  civil  or  military,  foreseen 
or  unforeseen.  This  study  shows  why  traditional  measures  designed  merely  to  make 
energy  supplies  more  reliable  in  the  face  of  calculable,  predictable  kinds  of  tech¬ 
nical  failure  cannot  achieve  such  basic  resilience  and  may  even  reduce  it.  In 
contrast,  by  drawing  on  such  areas  of  design  as  biology,  telecommunications,  data 
processing,  nuclear  engineering,  and  aeronautics,  we  identify  practical  design 
elements,  technologies,  and  principles  of  system  architecture  which  can  make 
catastrophic  failures  structurally  impossible. 

The  most  cost-effective  approach  embodying  these  principles  is  to  increase  drama¬ 
tically  the  efficiency  of  using  energy.  This  displaces  the  most  insecure  marginal 
supplies,  stretches  time  constants,  shaves  peak  loads,  limits  extremes  of  system 
behavior,  and  greatly  increases  the  scope  for  improvised  supplies.  The  next  pri¬ 
ority  is  to  harness  a  wide  range  of  presently  available,  relatively  dispersed, 
renewable  sources  whose  scale,  location,  and  energy  quality  are  appropriate  to 
their  task.  In  combination,  and  with  due  attention  to  some  currently  ignored  de¬ 
tails  of  design,  technologies  for  high  energy  productivity  and  appropriate  renew¬ 
able  supply  would  provide  an  inherently  resilient  energy  system,  with  profound 
benefits  for  individual  and  national  security. 

It  is  thus  encouraging  that  these  two  types  of  measures  are  today  respectively 
the  cheapest  and  second-cheapest,  and  the  fastest-growing  and  second-fastest- 
growing,  contributors  to  national  energy  supply.  They  would  spread  even  faster 
in  a  truly  competitive  marketplace  or  with  greater  reliance  on  individual  and 
community  initiative  (some  grassroots  efforts  to  mobilize  such  resilient  techno¬ 
logies  are  already  underway).  This  analysis  thus  concludes  that  an  energy  policy 
consistent  with  free-market  principles  can  provide  lasting  energy  security  for  a 
free  society — if  the  foundations  of  that  security  are  clearly  understood. 
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PREFACE:  PURPOSE,  METHOD,  AND  SCOPE 


The  first  comprehensive  oversight  examination  of  Federal  efforts  towards 

nonmilitary  emergency  preparedness  opened  its  report  [Joint  Committee  on 

Defense  Production  1977:I-vii]*  with  this  finding: 

An  increasingly  complex,  technology-dependent,  industrial  economy  in  the 
United  States  has  made  citizens  more  than  ever  vulnerable  to  the  effects 
of  disasters  and  emergencies  over  which  they  have  little  or  no  control  and 
to  which  they  cannot  successfully  respond  as  individuals. 

Most  modern  systems  for  supplying  energy  carry  in  their  design  the  seeds  of 
this  brittleness:  complexity  of  components  and  structure;  highly  interactive 
and  poorly  understood  system  behavior;  likelihood  of  unexpected,  unpredictable 
disturbances;  difficulty  of  diagnosing,  repairing,  and  replacing  disabled 
parts;  proneness  both  to  exacerbate  and  to  be  disrupted  by  sociopolitical  ten¬ 
sions  and  instabilities;  potential  for  sudden  failure  on  a  massive  scale;  and 
profound  importance  for  well-being,  social  cohesiveness,  and  national  survival. 

Our  nation  has  invested  enormous  resources  in  military  measures  to  deter 
and  defeat  aggression,  and  to  project  U.S.  power  abroad  to  guard  perceived 
national  interests.  Yet  at  the  same  time,  we  have  made  both  this  military 
might  and  every  facet  of  our  civilian  life  dependent  on  an  energy  system  inher¬ 
ently  vulnerable  to  large-scale  failure,  whether  caused  by  accident  or  by 
malice.  We  have  developed  a  society,  for  example,  in  which  the  basic  functions 
of  life  depend  on  a  continuous  supply  of  electricity.  In  New  York  City,  trav¬ 
eling,  going  upstairs,  opening  doors,  even  walking,  eating,  seeing,  and  breath¬ 
ing  often  depend  on  the  electrical  supply.  Just  a  brief  faltering  of  such 
services  as  electricity,  gas,  food,  water,  and  sewage  treatment  can  manifest — 
sometimes  fatally — the  latent  brittleness  of  our  interdependent,  urbanized 
society.  Yet  the  systems  that  provide  these  services  seem  increasingly  to  be 
so  ordered  a3  to  magnify,  even  perhaps  to  maximize,  that  vulnerability. 

Our  electrical  systems,  for  example,  depend  on  many  large  and  precise 
machines,  rotating  in  exact  synchrony  across  a  continent,  and  strung  together 
by  an  easily  severed  network  of  aerial  arteries.  Electricity  cannot  be  readily 
stored  in  bulk,  so  failure  is  instantly  disruptive.  Failure  also  becomes  more 
damaging  and  less  tractable  on  a  large  scale.  The  very  size  and  complexity  of 

♦Throughout  this  report,  bracketed  citations  refer  by  author  and  date,  and  if 
needed  by  volume  and  page  number  (after  the  colon),  to  consolidated  references 
listed  alphabet ical ly  starting  on  page  280 .  Occasional  omissions  of  citations 
are  generally  to  protect  a  specific  point  of  vulnerability  from  being  identi¬ 
fied  or  to  honor  a  source’s  wish  that  a  statement  not  be  attributed. 
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modern  power  grids,  their  reliance  on  elaborate  control  and  cotnmun i cat i ons  sys¬ 
tems,  even  the  inherent  electrical  properties  of  long  transmission  lines,  tend 
to  increase  the  likelihood  and  consequences  of  major  failures.  There  "is  lit¬ 
tle  doubt"  that  a  few  high-altitude  nuclear  blasts,  perhaps  even  one,  "could 
black  out  all  U.S.  power  grids"  [Lerner  1981:43].  Even  more  strikingly,  we 
have  now  reached  the  point  where  a  handful  of  people  with  rifles  may  be  able  to 
turn  off  virtually  the  whole  country.  Such  homemade  threats  to  our  national 
security  appear  to  undermine  the  mission  of  our  Armed  Forces,  and  would  be  a 
grave  preparedness  problem  even  if  our  nation  had  no  adversaries  in  the  world. 

This  study  explores  in  detail  the  validity  of  such  concepts  as  a  linkage 
between  energy  vulnerability  and  central  electrification.  By  exploring  those 
technological  and  architectural  features  which  make  the  energy  system  brittle, 
the  analysis  seeks  to  identify  and  reduce  to  specific,  practical  form  those 
design  principles  that  can  make  our  energy  system  more  resilient,  less  vulner¬ 
able,  less  susceptible  to  catastrophic  failures:  in  short,  better  prepared  for 
all  kinds  of  disruptions,  whether  civil  or  military,  foreseen  or  unforeseen. 

The  motivation  for  tackling  this  difficult,  seemingly  amorphous  subject  is 
the  unpleasant  discovery,  on  reviewing  the  open  literature,  that: 

-  Comparative  vulnerability  has  been  analyzed  only  in  a  very  narrow  sense. 
There  is  no  conceptual  framework  for  assessing  vulnerability  to  a  full  range  of 
potential  disturbances.  Many  existing  methodologies  are  misleading,  because 

-  Most  analytic  and  design  efforts  seek  reliability  against  calculable 
technical  failures,  but  this  does  not  impart,  and  may  even  reduce,  resilience 
against  incalculable  or  unexpected  disruptions,  especially  deliberate  ones. 

-  Comparative  vulnerability  is  seldom  even  considered  as  a  criterion  in 
Federal  energy  policy  decisions,  whether  by  the  Congress  or  the  Executive. 

-  Technologies  and  system  designs  that  offer  the  greatest  potential  im¬ 
provements  in  preparedness  (together  with  other  important  advantages)  generally 
have  been  least  analyzed,  and  have  lowest  priority  in  current  Federal  policy. 

-  Most  trends  in  Federal  energy  policy  appear  to  be  increasing  vulnera¬ 
bility,  often  in  the  name  of  reducing  it:  specifically,  many  of  the  systems 
proposed  to  displace  imported  oil  are  themselves  subject  to  other  and  arguably 
graver  security  drawbacks. 

-  Preparedness  policies,  though  growing  beyond  their  traditional  emphasis 
on  the  threat  of  nuclear  attack,  remain  inadequate  to  mitigate  threats  posed  by 
the  increasing  structural  vulnerability  of  the  U.S.  energy  system. 

-  In  particular,  although  energy  preparedness  analyses  and  policies  have 
been  almost  completely  directed  towards  coping  with  reductions  or  interruptions 
of  oil  imports,  many  other  forms  of  energy  vulnerability — less  obvious  but  per¬ 
haps  even  more  dangerous — h  've  been  largely  neglected. 


These  other,  wider  vulnerabilities  form  the  main  (though  not  the  exclusive) 
focus  of  this  study.  The  Secretary  of  Defense's  statement  [Brown  1977]  that 
"there  is  no  more  serious  threat  to  the  long-term  security  of  the  United  States 
and  to  its  allies  than  that  which  stems  from  the  growing  deficiency  of  secure 
and  assured  energy  resources..."  is  true  in  a  far  broader  sense  than  he  presum¬ 
ably  intended;  and  this  study  seeks  systematically  to  explicate  that  sense. 

The  oil  problem  is  real,  difficult,  and  urgent.  Even  if  oil  reserves  were 
unlimited,  their  proprietors  permanently  friendly  and  reliable,  and  their 
delivery  systems  permanently  secure  from  interference,  there  would  be  serious 
national-security  problems  just  from  the  enormity  of  our  oil  import  bill. 

During  1979-80,  while  U.S.  oil  imports  fell  by  about  20%,  their  cost  rose  by 
nearly  50%  to  almost  $90  b ill  ion — equivalent ,  as  John  Sawhill  put  it,  to  the 
total  net  assets  of  General  Motors,  Ford,  IBM,  and  General  Electric,  or  to 
nearly  40%  of  all  U.S.  exports.  But  in  fact,  oil  reserves  and  resources  are 
limited;  many  of  their  main  proprietors  are  neither  friendly  nor  reliable;  much 
of  the  supply  line  stretches  halfway  around  the  world;  and  "every  main  oil 
loading  port  in  the  Persian  Gulf  and  most  of  the  Saudi  Arabian  and  the  United 
Arab  Emirates  oil  fields  are  within  900  miles  (a  90-minute  subsonic  flight)  of 
the  Soviet  Union"  (and  closer  still  to  Soviet  facilities  in  Afghanistan  and 
elsewhere)  [U.S.  General  Accounting  Office  1979:3].  "In  the  event  of  some 
future  confrontation,  the  Soviet  Union  might  be  able  to  restrict  access  of  the 
Western  World  to  its  essential  oil  supplies  to  a  degree  of  severity  and  dura¬ 
tion  greater  than  any  enbargo  by  the  oil  producers ....[ A] ct ion  to  interdict  on 
the  high  seas  tanker  movement  of  oil... could  vastly  exacerbate  the  oil  supply 
situat ion. ... "[Brown  1980] 

There  is  a  consensus  that  despite  ouch  effort,  oil  vulnerabilities  remain 
unacceptably  large  [Emergency  Preparedness  News  1980;  Deese  &  Nye  1981;  Yorke 
1980;  Aim  1981;  Marshall  1980;  Senate  Committee  on  Energy  &  Natural  Resources 
1980;  Aspen  Institute  1980].  Our  thesis,  however,  is  that  energy  is  far  more 
than  oil,  and  energy  security  is  far  more  than  ability  to  keep  the  oil  coming. 
Thus  even  if  the  oil  problem  is  solved,  major  and  unexamined  energy  vulnerabil¬ 
ities  will  remain.  Many  measures  being  used  to  "solve"  the  oil  problem  will 
indeed  make  those  other  vulnerabilities  worse.  Other  measures  not  now  being 
inplemented  could  probably  provide  both  greater  relief  of  oil  dependence  and 
more  cony  rehens ive  energy  security.  This  report's  emphasis  on  vulnerabilities 
other  than  imported  oil,  then,  arises  not  from  a  lack  of  concern  about  the  oil 
problem,  but  from  an  even  deeper  concern  that  the  whole  problem  of  energy  pre¬ 
paredness  has  been  misconceived.  Though  discussions  with  people  professional¬ 
ly  concerned  with  preparedness  have  consistently  elicited  intense  interest  in 
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this  thesis,  the  urgency  of  the  oil  problem  has  so  confined  analysts'  attention 
that  there  is  virtually  no  literature  directly  bearing  on  these  concerns.  With 
the  exception  of  one  project  now  underway  at  FOA  (the  Swedish  Defense  Research 
Establishment),  there  appears  to  be  no  comparable  analysis  anywhere  in  the 
world.  Our  investigations  also  revealed  that  although  some  individual  analysts 
in  the  Department  of  Energy  think  about  pieces  of  the  vulnerability  problem, 
the  Department  as  an  institution  has  not  yet  seriously  considered  the  broader 
preparedness  implications  or  the  inherent  vulnerabilities  of  energy  systems 
being  promoted  on  other  grounds.  This  report  seeks  to  begin  to  fill  that  broad 
and  important  gap,  even  if  in  a  preliminary  fashion  that  can  doubtless  be 
refined  by  those  with  greater  knowledge  and  resources. 

The  Federal  Emergency  Management  Agency  has  already  sponsored  a  parallel 
study  [Energy  &  Defense  Project  1980],  carried  out  independently  of  this  one, 
which  might  at  first  sight  appear  to  have  covered  its  concerns.  That  work  is 
helpful  and  relevant  but  largely  complementary  to  the  line  of  this  analysis. 

It  offers  an  opportunity  to  avoid  possible  overlap  by  simply  citing  much  of  its 
material — notably  its  readable  exposition  of  the  status  of  various  renewable 
energy  sources — but  this  report  aims  at  considerably  deeper  conceptual  analysis 
of  energy  vulnerability  and  resilience.  Both  studies  seek  to  address  FEMA's 
need  to  find  out  more  about  emerging  technologies  and  energy-system  design 
principles  that  can  enhance  preparedness,  and  to  alert  FEMA  to  actions  that  may 
be  needed  to  ensure  adequate  attention  to  preparedness  in  formulating  energy 
policy.  (Much  of  this  study  should  also  help  FEMA  in  its  counter-terrorism 
consequence  preparedness  planning.)  But  where  the  Energy  and  Defense  Project's 
efforts  are  directed  more  towards  a  survey  of  available  technologies,  this  ana¬ 
lysis,  while  including  ample  technological  material,  will  also  seek  to  systema¬ 
tize  in  far  greater  detail  some  design  principles  for  energy  resilience. 

This  study  is  of  necessity  exploratory  and  conceptual.  Because  the  prob¬ 
lem  as  framed  here  has  not  been  systematically  studied,  it  has  been  necessary 
to  synthesize  ideas  from  an  extensive  survey  of  many  diverse  literatures  (some 
in  subjects  not  normally  considered  in  research  of  this  kind)  and  from  dozens 
of  interviews  and  letters,  together  with  a  good  deal  of  hard  thinking.  The 
present  treatment  uses  quantitative  expression  where  it  will  illuminate  rather 
than  obscure  qualitative  insights,  but  avoids  opaquely  elaborate  computer 
models  of  concepts  better  kept  in  words:  much  of  the  argument  simply  does  not 
lend  itself  to  formal  modelling  so  much  as  to  analogy  and  anecdote.  Some  sec¬ 
tions  require  modest  technical  background  to  follow  in  detail,  but  most  are 
written  for  a  general  policy  audience  with  basic  numeracy.  References  are  also 
supplied  to  enable  specialists  to  dig  deeper  if  they  wish. 
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To  do  justice  to  the  richness  of  the  concepts  of  vulnerability  and  resil¬ 
ience,  and  to  organize  systematically  a  large  mass  of  supporting  examples,  it 
proved  necessary  to  rearrange  the  sequence  of  topics  originally  envisaged  in 
the  contractual  Statement  of  Work,  developing  the  same  subjects  in  an  order 
better  suited  to  the  intellectual  structure  of  the  argument.  For  the  reader's 
convenience,  the  following  key  shows  how  the  topics  in  the  Statement  of  Work 
(Clause  101.  General  Scope)  correspond  to  sections  of  the  text: 


"1. 


Background 

"(a)  Conventional  energy 


sources  as  well  as  the  new  emerging  energy  techno¬ 
logies  pose  substantial  public  risks  both  in  normal  operation  and  as  targets 
for  sabotage.  The  potential  positive  and  negative  events  which  may  derive  from 
traditional  and  new  sources  of  energy  have  not  been  identified  or  analyzed. 

"(b)  Current  civil  preparedness  policies  may  not  be  adequate  in  mitigating 
the  possible  adverse  impacts  of  alternative  energy  technologies.  The  proposed 
research  will  include  the  following: 

"2.  Specific  Work  for  Services  Chapter! s ) 

"The  contractor  shall ..  .conduct  an  inpact  analysis  of 
alternative  energy  technologies  to  include  but  not  be 
limited  to  the  following: 

"(a)  Identify  and  analyze  the  risks  and  benefits  in-  1-3 

herent  to  conventional  energy  technologies  and 
their  potential  vulnerability  to  natural  and  man 
made  disasters  (including  enemy  attack)  industrial 
accidents  and  sabotage. 

"(b)  Identify  and  analyze  the  risks  and  benefits  of  2 . 1 . 8 ,2 . 2 . 2-3  , 

emerging  renewable  energy  technologies  and  their  6-7 

potential  vulnerability  to  natural  and  man  made 
disasters  (including  enemy  attack)  industrial 
accidents  and  sabotage. 

"(c)  The[se]  analyses .. .will  include  but  not  be  limited 
to  such  factors  as  identification  of  fuel  types, 
delivery  methods, 

distance  and  risks  of  distribution  networks, 
ease  of  storability, 


.1 


ease  of  operation  and  repair, 

and  adaptability  to  alternative  fuel  sources 

and  cost-effectiveness  corrparisons . 


2.1 .5. 3. 2. 3. 3. 
2.1 .4,2.1 .7,3 

2. 1- 2, 2. 4, 3 

2. 1.4. 2.1 .6.3, 

6. 2- 3, 7.1 ,7.2.3 

2. 1.7. 2. 2- 3, 6. 2- 
3,7,8 

2.1 .5. 4. 4. 6. 2- 3, 
7.3.2 

5. 2, 6.1 ,6.4-5, 
7.2.1 ,7. 3. 1-2 

2.1.2- 3,2.1.10, 
4. 4, 6-8 


"(d)  Identify  and  analyze  the  potential  economic,  social 
and  political  impacts  of  emerging,  renewable  energy 
sources . 

"(e)  Review  and  discuss  civil  preparedness  policies 

to  determine  their  applicability  and  effectiveness 
in  mitigating  the  possible  adverse  impacts  of  alter¬ 
native  energy  technologies.  Consideration  will  be 
given  to  the  emerging  set  of  policies  associated 
with  renewable  energy  technology." 

To  ensure  a  coherent  understanding  of  how  these  subjects  interrelate,  however, 
the  reader  is  urged  to  study  this  report  as  a  whole  and  in  its  proper  order. 


2. 3, 3. 4. 4, 4. 4, 
5.2.10,6.3, 

7. 2. 3, 8 
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Any  analysis  of  vulnerabilities  mist  be  carefully  framed  in  order  not  to 
provide  a  manual  for  the  malicious.  Every  effort  has  been  made  here  to  omit 
those  concepts  and  technical  details  which  would  be  useful  to  a  saboteur  with 
sufficient  skill  and  insight  to  be  effective  in  the  first  place:  that  is,  the 
materiaL  presented  is  meant  to  be  grossly  insufficient  to  help  persons  who  do 
not  have  such  skill  and  superfluous  to  those  who  do.*  Some  residual  risk  will 
nonetheless  remain — perhaps  the  price  of  free  and  informed  discussion  in  a 
democracy.  We  believe  the  only  thing  more  dangerous  than  discreetly  discussing 
these  distressing  matters  is  not  discussing  thenr-hence  leaving  the  real  dan¬ 
gers  to  be  enshrined  in  public  policy  and  exploited  by  ingenious  malevolence. 

The  boundaries  of  this  analysis  exclude,  among  other  important  topics, 

U.S.  defense  and  military  policy;  most  of  the  social,  political,  and  psycho¬ 
logical  dimensions  of  preparedness  [Dresch  &  Ellis  1966];  save  in  passing,  vul¬ 
nerabilities  outside  the  sphere  of  energy  policy;  the  detailed  structure  of 
U.S.  institutions  and  policies  for  preparedness;  and  the  detailed  relevance  of 
the  thesis  to  U.S.  allies  or  adversaries  or  to  nonaligned  (especially  develop¬ 
ing)  countries.  This  report  should  not  be  viewed  as  a  fundamental  critique  of 
U.S.  energy  policies  on  grounds  other  than  their  relevance  to  preparedness.  It 
seeks  to  analyze  how  energy  policy  institutions  should  think  about  vulnerabili¬ 
ty  rather  than  to  specify  how  those  thoughts  should  be  enbodied  in  institution¬ 
al  structure.  Further,  the  1981  change  of  Administration,  the  subsequent 
transition  period,  and  the  autumn  1981  proposal  to  abolish  the  Department  of 
Energy  complicate  any  description  of  Federal  energy  policy.  While  broad  policy 
principles  were  enunciated  in  July  1981  (DOE  1981a],  it  is  not  yet  clear  how 
generalities  will  be  specifically  implemented  nor  how  certain  internal  tensions 
will  be  resolved.  Given  such  flux,  this  report  can  only  describe  synoptic 
trends  for  the  next  few  years  as  the  Federal  energy  role  diminishes. 

Finally,  though  we  have  extensive  practical  experience  of  local  prepared¬ 
ness  (organizing  responses  to  storms,  fires,  etc.),  we  are  not  experts  on  pre¬ 
paredness  in  the  sense  in  which  many  FEMA  staff  are.  But  from  energy  policy, 
our  main  field  of  professional  activity,  we  hope  to  offer  some  insights  which, 
while  perhaps  not  in  the  accustomed  language  or  mode  of  thinking  of  many  pre¬ 
paredness  studies,  will  be  fresh  and  provocative.  If  this  analysis  stimulates 
more  sophisticated  successors  which,  in  a  few  years,  make  this  one  look  primi¬ 
tive  by  comparison,  it  will  have  succeeded  in  drawing  attention  to  a  grave  and 
overlooked  threat  to  both  individual  and  national  security. 


*The  authors  are  familiar  with  this  problem  through  working  with  reviewers 
at  the  nuclear  weapons  laboratories  to  ensure  discretion  in  certain  unclassi¬ 
fied  technical  papers,  e.g.  [Lovins  1980]  (reprinted  in  Appendix  B). 
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1 .  NATIONAL  SECURITY  AND  PREPAREDNESS 


1.1.  Preparedness  for  what? 

What  is  national  security?  The  phrase  "is  at  best  an  ambiguous  symbol" 

and  "tends  to  change .. .over  time  unless  defined  in  terms  of  basic  constructs." 

According  to  a  Polaris  submarine  captain  turned  political  scientist, 

It  is  often  used  by  Congress,  the  President,  the  Courts,  or  individuals  or 
corporations  to  propose  or  to  justify  measures  not  supported  by  existing 
public  perceptions.  It  is  used  only  less  sparingly  than  the  phrase  "in 
the  national  interest"  which  has  a  built-in  attraction  for  the  zealot,  the 
scoundrel,  and  the  patriot  alike.  [Bucknell  1979:2] 

Despite  overuse  and  perhaps  abuse,  the  term  "national  security"  speaks  to 
important  and  legitimate  concerns.  Logically,  the  "basic  constructs"  defining 
it*  should  be  such  supreme  interests  as  life,  liberty,  and  the  pursuit  of 
happiness  or  of  economic  welfare.  Derived  from  such  overriding  national 
interests  or  values — and  from  the  principle  that  one  ought  never  to  have  to 
choose  between  them — are  corresponding  goals,  objectives,  policies,  and  policy 
instruments.  Thus,  world  peace  might  be  a  goal  serving  these  values;  a  just 
peace  in  the  Middle  East  might  be  an  objective  through  which  this  goal  can  be 
realized;  maintaining  alliance  structures,  containing  Communism,  recognizing 
nations'  right  to  live  peacefully  within  their  boundaries,  or  seeking  autonomy 
for  displaced  peoples  might  be  policies  toward  achieving  that  objective;  and 
instruments  of  such  policies  might  include  diplomacy,  foreign  aid,  war,  trade 
and  resource  policy,  etc.  Military  force,  then,  is  only  a  means  to  serve 
higher  ends  [Nevins  1979].  But  the  traditional  formulation  of  national  secur¬ 
ity  objectives,  vintage  pre-1965  or  so,  frames  them  as  if  both  threats  and 
responses  were  primarily  military.  A  spectrum  of  such  objectives  could  include: 

-  Maintaining  stable,  predictable  international  alignments  and  fostering 
sound,  lasting  alliances. 

-  Maintaining  influence  and  confidence  to  mediate  others'  disputes  peace¬ 
fully  rather  than  being  drawn  into  them  militarily. 

-  Seeking  a  comity  between  nations  and  peoples  which  will  minimize  the 
likelihood  of  resort  to  military  means  of  settling  disputes. 

-  Retaining  in  an  interdependent  world  sufficient  freedom  of  action  to  be 
able  to  conduct  an  independent  foreign  policy  that  does  not  require  compromise 
between  vital  national  interests. 


*We  consider  here  only  concrete  elements  as  opposed  to  percept  ions  of  nation¬ 
al  security.  Such  observers  as  Lasswell  ]1977]  argue  that  the  latter  are  at 
least  as  important  to  the  way  people  and  nations  behave. 
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~  Achieving  security  from  cutoff  of  vital  supplies,  such  as  oil  [Collins  & 
Mark  1979],  food,  and  key  minerals*. 

-  Inhibiting  the  vertical  and  horizontal  spread  and  the  refinement  of 
nuclear  weapons  and  other  weapons  of  mass  destruction. 

-  Reducing  the  likelihood  and  consequences  of  terrorism  and  surrogate  war. 

-  Reducing  the  likelihood  and  consequences  of  direct  military  attack  on 
the  territory  of  the  United  Statest  or  of  treaty  allies. 

The  principal  precondition  for  achieving  these  objectives,  and  for  effec¬ 
tive  use  of  diplomacy,  trade  negot i at  ions ,  and  other  non-mili  t ary  policy  instru¬ 
ments,  has  long  been  considered  to  be  military  strength. 

Military  strength  in  turn  requires  reliable  access  to  many  resources.  Of 
these,  among  the  most  important  is  energy  in  suitable  forms  to  drive  the  en¬ 
gines  of  war.  In  World  War  II,  the  Allied  loss  of  550  oil  tankers  at  sea  was 
made  up  by  the  ability  of  U.S.  industry — then  fueled  chiefly  by  coal — to  build 
908  more  [Bucknell  etal.  1979:16].  The  coal  was  domestic;  the  diversity  was 
crucial.  In  the  Suez  Crisis  of  1956,  U.S.  oil  surge  capacity  permitted  the 
resupply  of  Europe.  That  flexibility  has  since  disappeared. 

Vietnam  was  America's  first  largely  oil-fueled  war,  and  its  direct  use  of 
some  1.1-1. 2  million  barrels  of  oil  per  day — some  9%  of  total  national  oil 
consumption,  or  nearly  twice  the  fraction  lost  in  the  1973-74  Arab  oil  embargo 
[J^.  :18-20] — accelerated  the  rapid  shift  of  the  United  States  to  being  a  net 
oil  importer.  Any  future  wars  may  have  to  be  fought  largely  with  oil  procured 
from  foreign  countries  and  delivered  in  foreign  vessels  by  foreign  crews  [id.: 
21].  Fighting  a  replica  of  World  War  II  today  with  902  of  our  oil  imports 
interdicted  would  require  roughly  half  the  nation's  total  oil  consumption 
[_id_.  :22]  ,  implying  drastic  civilian  rationing  if  not  worse,  and  accentuating 

♦Many  of  the  energy  issues  considered  in  this  study  apply  also  to  non-fuel 
minerals.  Among  the  more  useful  introductions  to  this  enormous  field  are 
[Fishman  1980;  Broad  1980;  Stanley  1977;  Goodman  1978;  Joint  Committee  on 
Defense  Production  1977:1:87-97;  Office  of  Technology  Assessment  1979;  Ayres  & 
Narkus-Kramer  1976;  Krause  1981;  Kihlstedt  19~7;  Lovins  1973]. 

TSome  analysts  [Boston  Study  Group  1979]  believe  that  because  of  geography, 
there  is  no  significant  military  threat  to  the  territory  of  the  United  States 
that  can  be  defended  against:  apart  from  minor  incursions  handled  by  the 
Coast  Guard,  the  only  overt  external  risk  is  from  strategic  nuclear  attack, 
which  cannot  be  defended  against,  although  it  may  be  deterred.  (A  modest 
Poseidon  fleet  would  do  this:  each  of  the  31  Poseidon  submarines  has  16  mis¬ 
siles,  each  capable  of  carrying  10-14  MIRVs — a  total  of  160-224  independently 
targetable  warheads  per  submarine,  or  about  one  for  each  of  the  218  Soviet 
cities  of  over  100,000  population.  Each  warhead  has  a  nominal  yield  of  about 
40  kT— three  Hiroshimas--and  would  kill  roughly  half  the  people  in  an  area  of 
the  order  of  15  square  miles.)  In  this  view,  the  United  States  itself  could 
be  adequately  defended  with  some  3%  of  its  present  military  budget,  and  the 
remainder  is  for  general-purpose  forces  to  defend  U.S.  allies  and  trade  routes 
and  to  protect  other  U.S.  interests  abroad.  Further  pursuing  such  arguments, 
or  the  deterrence  doctrine  [Dyson  1981],  is  beyond  the  scope  of  this  study. 


the  dangers  of  a  protracted  war  of  attrition  against  a  country  with  relatively 
secure  oil  access  ;  2  3  ]  .  Indeed,  this  may  underest  imate  the  problem,  since 

modern  weapons  require  very  highly  refined  fuels — a  barrel  of  JP4  jet  fuel 
needs  about  two  barrels  of  crude  oil  [_id_.  :25] — and  present  surge  capacity  and 
stockpiles  are  too  limited  for  any  but  the  briefest  of  wars.  (DOD  stockpiles 
in  197b  were  about  one  month's  peacetime  use  [ Congressional  Research  Service 
1978:44].)  The  serious  problem  of  guaranteeing  fuels  for  today’s  military 
establ ishmenf  (Moreland  1979]  naturally  lends  a  sense  of  urgency  to  military 
assessments  of  energy  security. 

In  recent  years,  however,  it  has  become  clear  that  these  justified  mili¬ 
tary  concerns  reflect  in  microcosm  the  role  of  energy  in  the  vulnerability  of 
the  whole  economy.  "Of  the  most  immediate  concern"  among  "the  main  long-range 
trends  that  could  threaten  U.S.  security,"  according  to  the  1978  DOD  Annual 
Report  [Brown  1978:26-27],  is  "the  worldwide  increase  in  the  consumption  of 
energy,  and  especially  oil."  The  goal  of  mitigating  that  threat  led  to  four 
"major  objectives  for  U.S.  energy  policy"  [id.]:  providing  "secure  access  to 
the  energy  necessary  to  maintain  our  standards  of  living  and  continue  our  eco¬ 
nomic  growth,"  ensuring  the  same  opporfuni t ies  for  our  allies,  avoiding  exces¬ 
sive  dependence  on  one  type  or  source  of  energy,  and  keeping  "the  major  sources 
of  energy  from  falling  into  unfriendly  hands.  These  conditions,"  concluded  the 
Secretary,  "are  essential  to  U.S.  security" — for  only  by  meeting  them  "can  we 
surmount  the  energy  crisis.  Only  by  surmounting  the  energy  crisis  can  we 
retain  the  strength  necessary  to  uphold  U.S.  security."  But  the  stated  objec¬ 
tives  are  to  be  pursued,  not  by  increasing  military  strength,  but  by  the  famil¬ 
iar  non-mi  1  i t ary  means  of  national  energy  policy  as  a  whole:  expanding  domestic 
reserves,  diversification,  substitution,  conservation,  and  stockpiling  [id. ] 
Further,  a  largely  military  approach  to  national  security  seems  increas¬ 
ingly  unresponsive  to  the  interdependenc i es  of  a  world  in  which  the  religious 
trends  in  Saudi  Arabian  society  or  the  rate  of  decline  of  Romanian  oil  reserves 
can  be  as  significant  to  U.S.  oil  supplies  as  Soviet  expansionism.  As  General 
Maxwell  D.  Taylor  [1976]  remarked, 

Most  Americans  have  been  accustomed  to  regard  national  security  as  some¬ 
thing  having  to  do  with  the  military  defense  of  the  country  against  a 
military  enemy,  and  this  as  a  responsibility  primarily  of  the  armed  forces 
....To  remove  past  ambiguities  and  recognize  the  widened  spectrum  of 
threats  to  our  security,  we  should  recognize  that  adequate  protection  in 
the  future  must  embrace  all  important  valuables,  tangible  or  otherwise,  in 
the  form  of  assets,  national  interests,  or  sources  of  future  strength.... 
An  adequate  national  security  policy  must  provide  ample  protection  for  the 
foregoing  classes  of  valuables,  wherever  found,  from  dangers  military  and 
non-military,  foreign  and  domestic,  utilizing  for  the  purpose  all 
appropriate  forms  of  national  power. 

Likewise,  Moreland  and  Bucknell  [1978:6]  emphasize  that 


...national  security  in  its  total  sense  is  not  simply  a  matter  of  defend¬ 
ing  against  external  threats  or  becoming  embroiled  in  wars  abroad.  The 
internal  security  of  our  country  is  properly  a  matter  of  national  security 
concern.  Because  of  the  ubiquitous  effects  of  energy  supply  and  use  in 
our  society,  it  is  apparent  even  now  that  major  fuel  shortages  and  a 
failure  to  undertake  conservation  and  to  develop  alternative  supplies  in  a 
timely  manner  could  lead  to  severe  conditions  of  depression,  social 
unrest,  violence,  and  political  peril.  Similarly,  the  threat  of  those 
dangers  could  cause  us  to  undertake  wars  for  which  we  are  ill-prepared. 

In  response  to  wider  threats,  a  correspondingly  broadened  concept  of  prepared¬ 
ness  has  evolved  [Joint  Comnittee  on  Defense  Production  1978:1:3-4): 

At  the  close  of  World  'sr  II,  the  terms  "preparedness"  or  "readiness" 
had  an  almost  exclusively  military  connotation.  To  the  extent  that  they 
applied  to  civilian  activities,  these  terms  related  to  prudent  measures 
deemed  necessary  to  protect  the  civilian  populace  against  enemy  attack  or 
to  assist  in  converting  the  civilian  economy  to  a  wartime  footing.*** 

In  the  intervening  decades,  however,  the  term  "preparedness"  has  come 
to  have  a  much  broader  significance.  It  now  includes  not  only  measures 
aimed  at  securing  the  country's  defenses  and  the  protection  of  the  popula¬ 
tion,  but  also  a  host  of  activities  designed  to  prevent  or  mitigate  the 
effects  on  persons  and  property  of  natural  disasters,  resource  crises  and 
other  economic  disruptions,  industrial  and  transportation  accidents — such 
as  nuclear  powerplant  emergencies,  spillage  of  flammable  or  corrosive 
chemicals,  train  derailments — and  certain  forms  of  terrorist  activity. 

The  growth  in  the  significance  of  the  word  preparedness,  although 
little  remarked,  has  resulted  primarily  from. ..(1)  the  increasing  vulnera¬ 
bility  of  a  complex,  highly  interdependent  industrial  society,  and  (2)  the 
increasing  demands  made  on  Government  by  citizens  whose  lives  may  be  dra¬ 
matically  affected  by . . .emergenc i es  they  are  unable  to  prevent  or  control. 
***(The  "Murphy"  Commission  on  the  Organization  of  Government  for  the 
Conduct  of  Foreign  Policy,  June  1975,  found]. ..an  overemphasis  on 
. . .security  defined  in  narrow  military  terms  as  against 
broader  security  considerations  and  broader  "economic", 

*' foreign  policy",  and  ‘'domestic11  concerns.  In  fact  ,  given 
most people's  views  about  today's  problems  and  the  problems  of 
the  next  decade,  the  structure  of  the  1940's  is  no  longer 
appropr iate .  Even  for  security  against  physical  threats  to 
American  life  or  property,  armies  no  longer  fully  suffice. 

[Emphasis  in  original.) 

Citizen  concern  for  protection  against  a  tornado,  a  nuclear  power-plant 
meltdown,  a  flood,  or  a  prolonged  cessation  of  viral  transportation 
reflects  the  common  sense  understanding  that  the  security  of  life  and 
property  is  composed  of  more  than  defense  against  enemy  invasion  or 
coercion.  This  is  not  to  underrate  the  significance  of  armies.  It  is 
rather  to  give  full  meaning  to  the  idea  of  securing  the  general  good  of 
the  populace. 

Again,  attacking  historical  but  artificial  distinctions  [id.: 34— 35 )  : 

Among  the  most  serious  of  recent  trends  is  the  tendency  to  make  nuclear 
attack  preparedness  an  entirely  separate  and  distinct  function  from  peace¬ 
time  emergency  preparedness.  This  is  of  particular  concern  in  view  of  the 
mounting  evidence  of  increased  social  and  economic  vulnerability  to  non¬ 
military  threats  or  disasters.  A  rigid  distinction  of  this  kind  also 
contradicts  the  experience  of  most  planners  that  the  most  important  pre¬ 
paredness  functions  are  non-specific  as  to  type  of  disaster  and  that 
programs  directed  against  the  most  common  types  of  peacetime  disasters 
provide  an  excellent  base  for  nuclear  attack  response. 
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This  enlarged  conception  and  operational  structure  of  preparedness 
reflects  a  broad  evolutionary  view  of  its  changing  mission  (Hermann  1977].  As 
Bucknell  [1979:4-11]  summarizes  the  task: 


Siftguards 


Social  and  Economic  Security 
t  E rougK : 

a.  Economic  Growth  and/or 

b.  Income  Redlstr I  but  Ion 

Education 


Economic.  Hit Itary,  and 
Technical  A  Id 


Alliances  and  Security  Pacts 
Military  Forces 


chppuww  ENERGY  AW'Pey'wi 
ELEMENTS  OF  NATIONAL  SECURITY 


Values  disputed  and  continuously 


given  new  priorities  under  con¬ 
ditions  of  domestic  trangulllty 


Const! tut  Iona  I  Government  subject 
to  evolutionary  change  through 
general  consensus 


Physical  Security 


a.  Of  basic  human  needs  (food, 
shelter,  transportation,  etc.) 

b.  Of  home  territories: 

1.  from  domestic  disturbance 
and  violence 

2.  From  Invasion  or  direct 
attack 

c.  Of  vital  foreign  Interests 
(subject  to  change) 


Threats 


Lack  of  Economic  Security 
and  TtaE i  1  1  ty 

Economic  and  Social 
InequlTy 

Terrorism  and  Civil  Unrest 
Demagogic  Conditions 
Changing  World  Alignments: 

a.  Economical ly 

b.  Politically 

Hostile  Military  Forces 


The  demand  for  and  the  supply  of  Energy  affects  all  of  the  Safeguards  and 
Threats  to  the  Elements  of  National  Security.  They,  In  turn,  are  affected 
by  the  supply  and  demand  of  energy . 


An  awareness  of  the  broader  energy  vulnerabilities  of  our  society,  then, 
suggests  such  national  security  objectives  as: 

-  Essential  self-reliance  and  sustainability  in  vital  resources,  including 
energy.  Since  many  of  these  resources  are  procured  from  developing  countries, 
this  implies  attention  to  their  continued  willingness  to  sell  those  resources, 
hence  to  their  economic  and  political  stability  and  well-being. 

-  Resource-distribution  and  -use  systems  capable  of  tolerating  sudden, 
major  decreases  in  supply  of  key  resources,  singly  or  in  combination. 

-  A  flourishing,  adaptive  economy,  free  of  "choke  points"  in  which  disrup¬ 
tions  could  have  critical  national  impact  [Joint  Committee  on  Defense 
Production  1977:11:34]. 

-  Domestic  and  international  financial  institutions  designed  to  ensure 
integrity,  promote  stability,  and  deserve  confidence. 

-  Avoidance  of  large-scale  public  and  occupational  health  and  safety 
hazards  arising  from  the  energy  system. 

-  Protection  of  ecological  variety  and  stability,  with  special  attention 

to  natural  materials  cycles,  climate,  and  the  basis  of  long-term  biological 
productivity  (e.g.  in  agriculture). 

-  Domestic  tranquility,  based  on  social  justice,  pluralism,  and  shared 
respect  for  democratic  values. 
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The  price  of  failing  to  achieve  these  objectives  can  readily  be  framed  in 
economic  terms,  for  example  in  the  Undersecretary  of  Stare's  concise  account  of 
interconnections  within  the  non-military  world  oil  problem  [Cooper  1978:244]: 

If  our  nations  do  not  prepare  for  the  oil  shortfall  in  the  1980's,  the 
framework  of  international  cooperation  which  we  have  worked  so  hard  to 
build  since  World  War  II  will  be  imperiled.  Severe  economic  disturbances 
would  be  followed  in  some  countries  by  political  instability.  The  trend 
toward  freer  international  trade,  which  has  been  responsible  for  much  of 
our  post  World  War  II  prosperity,  would  surely  be  reversed  under .. .reces¬ 
sion  and  oil-induced  balance-of-payment s  difficulties.  The  prosperity  and 
cohesion  of  the  Western  industrialized  nations  would  be  at  stake,  putting 
in  jeopardy  our  own  security  and  ultimately  our  way  of  life. 

The  non-oil  producing  developing  countries  would  also  be  hard  hit  eco¬ 
nomically.  These  nations  are  not  profligate  energy  users;  [they]  use  very 
little  energy,  but  their  economic  development — both  in  industry  and  agri¬ 
culture — depends  on  the  availability  of  imported  energy.  If  oil  prices 
are  rising,  the  burden  on  the  already  fragile  external  financial  condition 
of  these  countries  would  become  insupportable.  The  cost  of  their  imports 
would  rise,  and  in  world  recession  their  exports  will  contract.  Economic 
development  would  stop,  if  not  regress. 

These  conditions  would  breed  international  turmoil  and  foster  revolutionary 
doctrines  and  political  extremism.  Speaking  of  the  political  fallout  from 
inflation  that  occurred  decades  before  oil  prices  started  to  drive  it,  Helmut 
Schmidt,  while  serving  as  F.R.  Germany's  Finance  Minister,  remarked:  "I  have 
only  to  go  to  the  years  1931  to  1933  to  say  that  the  meaning  of  stability  is 
not  limited  to  prices."  [Brown  I977a:33] 

Today  in  America,  the  inflation,  unemployment,  and  frustration  arising 
from  further  energy  scarcity  could  endanger  "an  environment  where  competing 
values,  needs  and  interests  are  resolved  lawfully  and  not  through  resorts  to 
violence"  [Hoover  1979:1].  Simply  having  to  wait  in  line  to  buy  gasoline  has 
led  some  Americans  to  shoot  each  other.  With  many  other  Americans  already  hav¬ 
ing  to  choose  daily  between  heating  and  eating,  and  with  safety  margins  of  per¬ 
sonal  survival  rapidly  shrinking,  both  hardship  and  anger  would  be  bound  to 
rise  in  more  dramatic  shortages.  With  them  would  rise  interregional  tensions 
and  the  problems  of  declining  industrial  regions — "[pjopulat ion  out-migration, 
urban  decay,  declining  local  tax  bases,  and  increasing  social  service  costs.... 
Sharing  social  costs  of  energy-related  unemployment ,  under-employment ,.. .and  so 
on. . .exacerbates  longstanding  and  resistent  differentials  between  racial  and 
ethnic  minor  i  t  ies ..  .and  the  majority  population."  [_i_d_. :  1 6— 17]  "The  need  for 
taking  rapid  and  decisive  action  to  reduce  energy  vulnerability,  internal  and 
external,  directly  clashes  with  the  need  for  extended  debate  and  compromise  to 
resolve  distribution  of  energy-related  benefits,  costs,  hazards  and  deficits." 
[_id^.  :20]  Such  stresses  could  lead  to  civil  disorders  or  perhaps  even  to  domes¬ 
tic  terrorism.  In  this  way  too,  the  energy  problem  hazards  our  democratic 
practices,  our  most  deeply  held  values,  and  our  supreme  national  interests. 

These  sources  of  domestic  instability  in  turn  pose  military  dangers,  for 


"Deterrence  is  not ...  simply  a  matter  of  operational  hardware.  Potential 
antagonists  trust  also  believe  that  the  social  and  political  fabric  of  the 
U.S.  is  sufficiently  whole  that  this  force  would  be  employed  if  the  coun¬ 
try  were  threatened  by  direct  nuclear  attack.  Equally  important  is  [the] 
perception  that  the  U.S.  is  sufficiently  stable  that  strategic  nuclear 
forces  will  not  be  deployed  in  a  first  strike.  It  is  certainly  conceiv¬ 
able  that  the  political  and  social  stability  of  American  society  could  be 
threatened  by  economic  and  social  strains  of  energy  scarcity  to  the  point 
where  the  credibility  of  nuclear  deterrence  is  lessened.  However,  most 
observers  do  not  see  increased  vulnerab il ity  to  direct  military  attack  as 
the  most  likely  or  urgent  impact  of  energy  scarcity  on  U.S.  security. 
Secondary  impacts  of  U.S.  failure  to  deal  with  energy  scarcity  are  more 
inportant.  Oil  imports  of  a  scale  that  would  put  other  industrial 
economies  at  great  risk  [are]... an  example.  [Hoover  1979:2-3] 

The  military  and  non-military  threats  which  the  energy  problem  poses  to 

our  society  are  thus  intricately  inte.*.  inked  and  feed  on  each  other.  As  Lester 

Brown's  survey  of  emerging  national  security  issues  concludes  [ 1 977a: 37-40 ] : 

The  military  threat  to  -<*►  ional  security  is  only  one  of  many  that  govern¬ 
ments  must  now  address.  The  numerous  new  threats  derive  directly  or  in¬ 
directly  from  the  rapidl’  hanging  relationship  between  humanity  and  the 
earth's  natural  system*  en^l  resources.  The  unfolding  stresses  in  this 
relationship  initially  manifest  themselves  as  ecological  stresses  and 
resource  scarcities.  Later  they  translate  into  economic  stresses — infla¬ 
tion,  unemployment,  capital  scarcity,  and  monetary  instability.  Ultimate¬ 
ly,  these  economic  stresses  convert  into  social  unrest  and  political 
instability. ***Non-mil itary  threats  to  a  nation's  security  are  much  less 
clearly  defined  than  military  ones.  They  are  often  the  result  of  cumula¬ 
tive  processes  that  ultimately  lead  to  the  collapse  of  biological  systems 
or  to  the  depletion  of  a  country's  oil  reserves.  These  processes  in  them¬ 
selves  are  seldom  given  much  thought  until  they  pass  a  critical  threshold 
and  disaster  strikes .***The  purpose  of  national  security  del iberat ions 
should  not  be  to  maximize  military  strength  but  to  maximize  national 
security . ***The  continuing  focus... on  military  threats  to  security  may  not 
only  exclude  attention  to  the  newer  threats,  but  may  also  make  [their]... 
effective  address. . .more  difficult  (by  diverting  resources  from  them].*** 
At  some  point  governments  will  be  forced  either  to  realign  priorities  in  a 
manner  responsive  to  the  new  threats  or  to  watch  their  national  security 
deteriorate. 


This  study  deals  with  a  specific  class  of  threats  to  national  security: 
those  expressed  through  the  energy  system,  and  especially  the  kind  of  vulnera¬ 
bility  described  [Glassey  &  Craig  1978:330]  as  "the  degree  to  which  an  energy 
supply  and  distribution  system  is  unable  to  meet  end-use  demand  as  a  result  of 
an  unanticipated  event  which  disables  components  of  the  system.  The  kinds  of 
events  referred  to  are  sudden  shocks,  rare,  and  of  large  magnitude."  Later 
Chapters  will  develop  this  theme  in  detail.  This  section  will  first  seek  to 
put  specific  threats  ("what  can  go  wrong")  and  corresponding  preparedness 
measures  into  context  by  briefly  surveying  all  types  of  threats  to  the  security 
of  the  United  States.  Chapters  2  and  3  will  consider  what  these  threats  can  do 
to  energy  systems  and  to  specific  energy  technologies  respectively. 


1.2.  Foreseeable  threats. 
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Identifiable  and  foreseeable  threats  to  national  security  can  range  from 
natural  disasters  to  aggressive  physical  acts  (war,  terrorism,  sabotage)  to  ac¬ 
cidental  or  deliberate  failures  of  complex  technical  and  economic  systems.  Some 
have  mainly  a  tangible  or  economic  effect,  others  mainly  psychol og i ca 1  (as 
would  be  a  threat  to  introduce  a  potent  carcinogen  into  unspecified  water 
supplies).  Collectively,  they  offer  a  formidable  array  of  hazards  to  life, 
liberty,  the  pursuit  of  happiness,  and  the  preservation  of  democratic  values. 

1.2.1.  Natural  disasters. 

Perhaps  the  most  familiar  threats  with  which  preparedness  deals  are  those 
commonly  called  "natural  disasters" — though  they  may  in  fact  be  caused  or  ag¬ 
gravated  by  human  activity.  (For  example,  flooding  can  be  caused  by  dam  fail¬ 
ure  or  by  building  on  a  flood  plain;  unstable  climatic  conditions  may  be  rela¬ 
ted  to  such  stresses  as  carbon-dioxide  and  particulate  emissions,  deforesta¬ 
tion,  and  creation  of  urban  "heat  islands.")  For  some  "natural  disasters"  that 
are  sudden  and  catastrophic,  like  earthquakes,  volcanic  eruptions,  and  tsunamis 
(tidal  waves),  the  areas  at  risk  are  broadly  known  but  the  times  are  not.  Gene¬ 
ral  precautions,  though  often  inadequate  [Los  Angeles  Times  1981],  are  commonly 
taken,  such  as  reinforcement  of  buildings  and  upgrading  of  communications 
equipment  for  disastei — relief  services.  It  may  soon  become  possible — some 
authorities  believe  it  is  now  possible — to  give  "suspicion"  warnings  of  such 
disasters  a  few  days  in  advance,  though  this  capability  raises  thorny  legal  and 
political  questions.  Even  if  foreseen,  these  disasters  might  send  shock  waves 
through  the  economy:  there  is  currently  Federal  concern,  for  example,  that 
parts  of  the  insurance  industry  may  not  survive  the  $80+- bi 1 1 i on  damage  of  an 
expected  Richter  8+  earthquake  in  Los  Angeles  or  San  Francisco  [Smith  1980). 

Severe  weather  occurs  frequently  in  a  country  as  large  as  the  United 
States.  In  1973-75,  an  average  of  about  three  dozen  major  episodes  per  year 
caused  damage  totalling  about  a  half-billion  dollars  per  year  [Joint  Committee 
on  Defense  Production  1977:1:17-20].  Each  region  has  a  characteristic  spectrum 
of  such  disasters:  "hurricanes  are  especially  likely. ..in  Florida,  droughts  in 
Texas,  tornadoes  in  Oklahoma,  and  blizzards  in  Wisconsin."  [j_d_. :  1 7 )  Other  man¬ 
ifestations  include  windstorms,  ice-storms,  hailstorms,  landslides,  lightning, 
dust-storms,  and  floods.  In  1960  storms  which  killed  354  people,  ice  deposits 
over  8"  (20  cm)  in  diameter  built  up  on  wires  [Stephens  1970:13],  Tornado 
winds  can  exceed  500  mph  [_id_.:23].  Conditions  as  extreme  as  any  in  the  world 
can  occur  in  outwardly  innocuous  places:  in  New  Hampshire's  White  Mountains, 
the  officially  recorded  maximum  windspeed  is  231  miles  per  hour,  and  a  tempera- 


ture  drop  of  sixty  Fahrenheit  degrees  in  forty  minutes  has  been  unofficially 
observed  in  July.  Few  parts  of  the  United  States  are  essentially  free  of  risk 
from  extremes  of  weather,  though  the  frequency  of  extremes  varies  widely. 

In  many  areas,  "normal"  bad  weather  is  also  disruptive,  with  routine  snow¬ 
falls,  spring  thaws,  ice  breakups,  etc.  snarling  transportation  and  communica¬ 
tion  for  days  or  weeks  each  year.  This  is  also  coimon  in  other  countries:  in 
the  Soviet  Union,  for  example,  "seven  out  of  ten... roads  become  impassable" 
during  the  autumn  rains  that  left  the  German  offensives  of  1941  and  1942  bogged 
down  in  mud  {_i_d_:  11:22]  and  during  the  spring  thaw.  This  can  become  crucial  in 
coping  with  non-weather  emergencies.  For  example,  civil  defense  planners  have 
observed  that  severe  winters  and  frozen  ground  make  uinter  evacuation  of  Soviet 
cities  "not  feasible";  early  summer  evacuation  would  have  to  rely  on  depleted 
food  stocks  and  would  interfere  with  planting  "so  vital  to  the  weak  Soviet 
agricultural  system";  and  late  summer  evacuation  would  forego  harvesting 
late-ripening  crops  (i.e.  most  except  winter  wheat)  [_i_d_ .  ]  .  At  least  some  parts 
of  the  U.S.  presumably  have  different  but  analogous  evacuation  constraints. 

Weather  fluctuations  can  affect  wide  areas  for  periods  of  weeks,  months, 
or  (as  in  the  Sahelian  drought)  years.  In  the  U.S.  in  1980-81,  extreme  cold  in 
the  Midwest  and  Northeast,  and  extreme  heat  in  the  South,  caused  as  much  dis¬ 
location  as  a  major  hurricane,  but  spread  over  a  far  longer  period.  There  is  a 
consensus  in  the  climatological  coimnunity  that  global  weather  patterns  in  the 
past  decade  or  so  have  exhibited  considerably  greater  fluctuations  from  the 
mean  than  earlier  in  this  century  and  will  probably  continue  to  do  so  [Kirtland 
1981}.  Though  fluctuations  are  commonly  described  on  a  seasonal  basis  ("this 
winter  is  much  milder  than  last"),  other  time-scales  are  also  important.  The 
Colorado  River  Compact  of  1927,  for  example,  allocated  water  based  on  average 
flows  for  the  previous  decade,  but  subsequent  average  flows  have  been  smaller 
by  as  much  as  a  million  acre-feet  per  year.  The  abnormality  of  the  Compact's 
base  years  has  been  a  fruitful  source  of  litigation  ever  since  [Glassey  &  Craig 
1978:335-6] . 

Likewise,  most  of  today's  hybridized  crops  have  been  specially  bred  for 
best  performance  in  climatic  conditions  which,  though  they  seemed  normal  to 
plant  breeders  at  the  time,  were  in  fact  the  mitdest  since  the  last  Ice  Age. 
Persistently  more  erratic  and  severe  conditions,  such  as  now  seem  to  be  emerg¬ 
ing,  could  severely  test  the  ability  of  plant  breeders  to  readapt — especially 
since  the  genetic  base  is  being  deliberately  narrowed,  and  many  adaptable,  pri¬ 
mitive  strains  have  already  been  lost  (Myers  1981).  This  linkage  between  agri¬ 
culture  (or,  more  generally,  stable  biological  productivity)  and  climate  is  es¬ 
pecially  important  because  of  the  likelihood  that  global  climate  is  "almost- 
intransitive"  (Lorenz  1976;  Study  of  Man's  Impact  on  Climate  1971] — that  is, 
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subject  to  abrupt  changes  from  one  mode  of  behavior  to  another,  brought  about 
by  very  small,  seemingly  random  causes  but,  once  changed,  relatively  resistent 
to  changing  back  again.  This  feature  of  many  complex  feedback  systems  is 
explored  further  in  Chapter  4. 

It  is  highly  likely  that  we  do  not  yet  know  all  the  potentially  important 
tr,'gg<>fs>  consequences,  and  interactions  of  environmental  changes.  Consider, 
for  example,  one  narrow  area  of  concern — the  stability  of  regional  and  global 
climate.  These  are  some  of  the  unexpected  energy/climate  interactions  whose 
existence  was  first  widely  revealed  during  the  1970s: 

-  "Forcing"  the  nitrogen  cycle  by  using  synthetic  nitrogen  fertilizer 
increases  the  incidental  production  of  nitrous  oxide  by  denitrifying  bacteria 
in  the  soil  (especially  if  soil  pH  is  reduced  by  acid  rain).  Some  of  the 
nitrous  oxide  diffuses  up  to  the  stratosphere,  where  its  photochemical  products 
attack  the  ozone  layer,  especially  above  30  km,  thus  altering  stratospheric 
circulation  patterns.  Some  analysts  believe  that  neat — term  rates  of  artificial 
nitrogen  fixation  might  be  climatically  significant  [ Isaksen  1980]. 

~  Krypton-85  routinely  released  by  nuclear  reactors  and  reprocessing 
plants  can  apparently  alter  atmospheric  ionization  and  hence  the  distribution 
of  electric  charge  in  the  atmosphere  (the  fairweather  potential  gradient),  with 
unknown  but  potentially  large  effects  on  nimbus  rainfall  and  other  processes 
important  to  global  agriculture  and  heat  transport.  This  may  become  important 
at  concentrations  orders  of  magnitude  below  those  of  radiological  health  con¬ 
cern,  possibly  including  present  or  near-term  levels  [ Boeck  et  al .  1975]. 

-  An  oil  spill  in  the  Beaufort  Sea,  where  drilling  is  now  underway,  could 
arguably  spread  under  the  fragile  Arctic  sea-ice,  work  its  way  to  the  surface 
with  seasonal  melting  on  top  and  freezing  on  the  bottom,  make  the  top  of  the 
ice  gray  in  about  ten  years,  increase  its  solar  absorptivity,  and  so  lead  to  a 
probably  irreversible  melting  of  the  sea-ice,  with  dramatic  effects  on  hemi¬ 
spheric  weather  patterns  [Campbell  &  Martin  1973]*. 

-  Fluctuations  in  the  behavior  of  charged  particles  in  the  upper  atmos¬ 
phere  over  Antarctica  have  been  correlated  with  power  surges  in  the  North 
American  electrical  grid — apparently  coupled,  and  amplified  by  orders  of 
magnitude,  through  some  sort  of  resonance  effect.  The  climatic  relevance  of 
this  linkage,  if  any,  is  unknown  [Park  &  Helliwell  1978]. 

These  examples  could  as  well  have  been  taken  from  many  other  areas  of 
earth  science  (or  from  biology  or  even  political  and  social  science)  as  from 
climatology.  In  sum,  they  represent  a  cornucopia  of  disagreeable  surprises. 

When  environmental  conditions  change,  whether  they  be  climatic,  chemical, 
or  whatever,  different  organisms  adapt  at  different  rates  and  to  different 
degrees.  This  can  have  consequences  at  least  as  serious  as  the  change  itself. 
•Present  soot  levels  in  Arctic  air  may  also  be  of  concern  [Kerr  1981]. 
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Under  the  extreme  stresses  of  a  post-nucleai — war  environment,  for  example,  many 
insects  are  likelier  to  survive  than  higher  organisms  that  eat  them,  because 
insects  can  tolerate  several  orders  of  magnitude  more  radiation  [National  Acad¬ 
emy  of  Sciences  1975).  Plagues  of  crop  pests  are  a  plausible  result.  Already, 
considerable  outbreaks  have  been  induced  by  similar  differential  selection 
under  the  much  milder  stress  of  biocide  application.  Seemingly  trivial,  highly 
localized  environmental  change  can  also  cause  awkward  biological  adaptations. 
For  example,  the  young  of  the  Asiatic  clam  Corbicula  fluminea  [Miehf>r  1980], 
too  small  to  be  stopped  by  screens,  enthusiastically  and  prol i f i ca 1 ^ adapt  to 

the  warmth,  protection,  and  food-laden  water  flow  in  the  artificial  environment 

A 

of  f reshwater-cooled  steam  condensers.  Some  power  plants,  pumping  little  but 
clams,  have  had  to  shut  down  twice  daily  to  shovel  them  out. 

1.2.2.  Deliberate  actions. 

A  second  category  of  threats  is  those  caused  by  human  action,  arising 
either  outside  the  United  States  (wars,  embargoes,  interruptions  of  commerce) 
or  domestically  (sabotage,  terrorism,  etc.).  If  natural  disasters  happen  to 
strike  a  point  of  weakness,  that  is  an  unfortunate  coincidence;  but  malicious 
actions  deliberately  seek  out  and  exploit  vulnerabilities  so  as  to  maximize 
damage  and  constrain  possible  responses.  Thus  identifiable  vulnerabi 1  it ies  can 
invite  matching  attacks.  Identifiable  threats  meant  to  exploit  those  vulnera¬ 
bilities  elicit  responses  to  reduce  them.  These  responses  in  turn  are  bound  to 
have  characteristic  and  perhaps  different  vulnerabilities — which  may  be  lesser 
or  greater  than  the  original  ones  —  inviting  new  forms  of  attack,  and  so  on. 

This  iterative,  coevolutionary  process  reduces  total  vulnerability  only  if  it 
carefully  anticipates  the  new  vulnerabilities  created  by  responses  to  earlier 
ones.  Otherwise,  a  France,  seeking  to  reduce  Mideast  oil  dependence,  may 
become  equally  dependent  on  a  nuclear-electric  grid  which  (as  subsequent 
sections  will  suggest)  can  be  turned  off  even  more  easily  than  the  oil. 

Vulnerabilities  can  be  unexpected  by  both  attacker  and  victim.  The  Iran¬ 
ian  revolution's  dramatic  effect  on  world  oil  prices  was  probably  as  big  a  sur¬ 
prise  to  Iran  as  to  oil  importers.  Vulnerabilities  can  be  exploited  accident¬ 
ally:  Iran's  bombing  of  Iraqi  oil  facilities  was  meant  to  hurt  Iraq,  not  Italy, 
France,  Brazil,  and  India.  Surface  vulnerabilities  may  be  less  important  than 
deeper  ones:  a  military  attack  meant  to  maximize  immediate  damage  may  do  less 
long-term  harm  than  one  meant  to  hamper  recovery  [Joint  Committee  on  Defense 
Production  1977:11:37-38).  Modern,”  hi  gh- lethal  i  t  y  nuclear  warheads,  for 
example,  can  encourage  recovery-hampering  attacks  on  such  points  of  vulnerabil¬ 
ity  as  oil  refineries  in  the  United  States  [id.;  infra)  and  certain  Soviet  in- 
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sfallations  crucial  to  agriculture*.  The  latter  include  hydraulic  facilities 
(dams,  locks,  pumping  stations,  canals)  needed  to  irrigate  or  drain  four  mil¬ 
lion  square  miles  of  otherwise  barren  farmland,  and  factories  making  bulldozers 
and  tractors  (over  80%  of  the  latter  are  made  in  nine  factories)  [id.:II:65_ 
68],  Both  countries  appear  to  have  highly  vulnerable  transportation  sectors, 
but  in  different  ways:  the  Soviets  lack  a  highly  articulated  network  of  rail, 
canal,  and  especially  road  routes,  and  each  is  already  too  overtaxed  to  take  up 
much  slack  from  the  rest,  whereas  the  U.S.  has  such  a  network  (especially  of 
roads)  and  of  vehicles  to  run  on  them,  but  lacks  a  secure  supply  of  fuel  for 
those  vehicles.  (The  Soviets  shared  that  problem  even  in  1948-49,  when  a  U.S. 
targeting  plan  for  150  nuclear  weapons  gave  top  priority  to  refineries,  especi¬ 
ally  those  producing  aviation  fuel  [joint  Chiefs  of  Staff  1949/78].)  Subse¬ 
quent  chapters  will  deal  more  fully  with  the  vulnerabilities  of  energy  systems 
to  various  disruptions,  including  enemy  attack:  not  in  any  effort  to  duplicate 
the  extensive  analysis  that  has  doubtless  been  devoted  to  targeting  of  energy 
facilities,  but  rather  because  vulnerabilities  revealed  in  war  often  reflect 
others  that  may  prove  costly  in  domestic  disruptions  or  natural  disasters. 

Domestic  sources  of  disturbance,  besides  sabotage,  terrorism,  and  riots, 
may  include  strikes,  lockouts,  oligopolistic  withholdings  of  supply,  and  judi¬ 
cial  or  regulatory  restrictions  (such  as  injunctions,  permit  suspensions  or 
revocations,  and  declarations  of  pollution  control  emergency).  Obviously,  some 
of  these  may  carry  no  intent  to  cause  disruption,  and  may  indeed  be  pursued 
with  commendable  ulterior  motives. 

1.2.3.  Mi  stakes . 

Many  modern  technical  systems  are  liable  to  sudden,  large-scale  failure 
because  they  rely  on  elaborate  design  and  construction  techniques  whose  com¬ 
plexity  and  technical  adventurousness  are  conducive  to  serious  mistakes.  Thpse 
technical  failures  are  sometimes  called  "industrial  accidents,1'  but  "accidents" 
are  always  caused  by  something — ignorance,  carelessness,  overconfidence,  or  a 
combination.  Common  sites  of  major  failures  include  buildings,  bridges,  water 
or  sewage  plants,  dams,  locks,  tunnels,  aircraft,  trains,  or  containments  for 
toxic  or  hazardous  substances.  These  failures  may  be  manifested  or  accompanied 
by  fires,  explosions,  physical  collapses,  leaks,  spills,  etc.,  often  in  sequen¬ 
ces  (derailments  causing  spills  causing  fires  causing  further  releases)  which 
greatly  amplify  the  effects  (as  in  the  2-4  kT  1946  Texas  City  fertilizer  explo¬ 
sion  [Stephens  1970:74]).  Many  technical  failures  could  be  prevented  or  miti¬ 
gated  by  the  design  precautions  developed  for  energy  systems  in  later  chapters. 
Though  technical  failures  are  not  the  main  focus  of  this  study,  they  offer  cau- 


tionary  tales.  A  NASA  missile  worth  hundreds  of  millions  of  dollars  had  to  be 
blown  up  shortly  after  launch  because  a  single  sign  error  in  a  computer  program 
put  it  on  the  wrong  trajectory.  (Analogously,  had  there  been  a  nuclear  war 
during  a  substantial  period  in  the  1960s,  all  U.S.  ICBM  warheads  would  report¬ 
edly  have  missed  their  targets  by  a  large  and  systematic  margin  owing  to  an 
error  in  reentry  calculations.)  A  radar  image  of  the  rising  moon  once  caused  a 
U.S.  nuclear  attack  alert;  when  this  was  fixed,  a  flock  of  geese  caused  a  new 
alert  [Dumas  1976,1980].  There  were  151  false  attack  alerts,  four  serious,  in 
15  months  [Coates  1980].  The  great  care  applied  to  such  matters  is  clearly  not 
always  enough:  a  fire  incinerated  three  ApolLo  astronauts  on  27  January  1967, 
and  a  Space  Shuttle  nitrogen  purge  error  suffocated  a  worker  on  19  March  1981, 
in  extremely  high-technology  launch-pad  operations  where  the  utmost  precautions 
were  presumably  being  taken.  Some  technical  systems  are  simply  so  complex  as 
to  exceed  the  limits  of  attainable  reliability  and  foresight  (pp.  1 7 f f  infra) . 

1.2.4.  Command,  control,  and  communications  disruptions. 

Any  system  is  by  definition  most  vulnerable  to  disruption  through  its 
control  mechanisms — those  meant  to  affect  its  operation  most  by  applying  the 
least  perturbation.  The  management  structures  and  procedures  for  using  these 
control  systems,  and  the  communications  systems  used  to  provide  their  input  and 
convey  their  output,  share  in  this  enhanced  vulnerab il ity.  As  systems  grow 
more  conplex,  the  volume  and  speed  of  information  flow  needed  to  control  .he's 
grow  to  the  point  where  only  computers  can  cope  with  it.  Conputers'  undtscrinr- 
inating  willingness  to  do  what  they  are  told,  however  nonsensical,  increases 
control  vulnerability  by  further  concentrating  in  one  place  (albeit  perhaps  ac¬ 
cessible  electronically  from  many  other  places)  the  ability  to  affect  much  by 
little.  For  example,  a  Swedish  Government  assessment  of  "The  Vulnerable  Socie¬ 
ty"  [Wentzel  1979:4]  notes  that  the  central  computer  of  the  National  Social 
Insurance  Board,  in  the  northern  town  of  Sundsvall,  sends  over  50  million  pay¬ 
ments  or  financial  messages  per  year  (at  a  peak  rate  of  half  a  million  per  day) 
to  Sweden's  eight  million  people.  Conputer  failure  "would  affect  large  nunbers 
of  [people]...,  chiefly  those... with  the  least  social  and  economic  protection. 
[Non-military]  threats  to  the  computer. .. might  include  terrorism  for  political 
purposes,  fire  or  water  damage  [or  disruption  by  magnetic  or  electric  fields  or 
by  reprogramming].  Even  a  lengthy  power  cut  might  have  serious  repercussions. 
Other  critical  situations  might  arise,  for  instance,  from  an  industrial  dispute 
involving  personnel  working  with  the  computer."  [_id_. ]  Small  groups  of  systems 
analysts  and  programmers,  even  disgruntled  individuals,  can  now  constitute  a 
national  threat — which  is  why  Swedish  computer  experts  are  being  compartmental¬ 
ized  to  "redistribute  dependence  among  [more]  people"  lid.:  7], 
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The  Sundsvall  computer's  product  is  information,  including  instructions  to 
transact  financial  affairs.  The  product  of  energy  systems,  however,  is  deliv¬ 
ered  electricity,  oil,  gas,  etc.  Their  designers  have  tended  to  concentrate  on 
ensuring  the  supply  of  that  product,  rather  than  on  ensuring  proper  control  of 
the  in  format  ion  internally  controlling  that  delivery.  Most  assessments  of 
energy  vulnerability,  likewise,  deal  with  crude  disruptions — oil  embargoes, 
pipeline  or  transmission-line  sabotage,  etc. — when  in  fact  the  greatest  vulner¬ 
abilities  may  well  lie  in  misuse  of  control  systems.  This  subject  is  explored 
further,  with  specific  examples,  in  the  next  two  chapters. 

The  first  practical  demonstration  that  the  worst  vulnerabilities  may  arise 
within  control  systems  is  today  coming  not  from  energy  systems  but  from  tele¬ 
phones.  Highly  intelligent  and  dedicated  “phone  phreaks"  (or,  as  they  prefer 
to  be  called,  "communications  hobbyists")  are  causing  serious  loss  of  revenues 
for  both  public  and  private  telecommunications  companies  in  the  U.S.  An  esti¬ 
mated  20%  of  the  traffic  on  ARPANET  is  unauthorized.  Some  supposedly  secure 
military  communications  links  have  been  accidentally  penetrated  by  experimen¬ 
ting  students.  The  phone  phreaks'  ingenuity  keeps  them  generally  several  steps 
ahead  of  security  precautions.  Using  microcomputers,  they  can  break  codes  and 
find  passwords  by  automatic  dialling.  They  collaborate  pseudonymously  via  com¬ 
puter  teleconferencing  networks  and  newsletters,  some  of  which  are  specifically 
devoted  to  technical  measures  for  fooling  control  systems  into  giving  something 
for  nothing  (such  as  free  phone  calls,  tele*.,  water,  electricity,  gas,  photo¬ 
copying,  computer  time,  and  cable  TV).  Some  newsletters  of  "anti-system  tech¬ 
nology"  focus  even  more  narrowly  on  ways  to  "crash"  telephone  and  time-sharing 
computer  systems — an  occasional  result  of  random  intervention,  but  much  easier 
to  accomplish  with  understanding  and  purpose.  It  appears  that  one  person, 
without  compromising  identity  or  location,  can  crash  most  or  all  of  a  corporate 
or  commercial  telephone  network  and  keep  it  down  more  or  less  indefinitely, 
perhaps  causing  significant  damage  to  electromechanical  components  in  the 
process.  Most,  and  with  sufficient  effort  perhaps  all,  communications  systems 
whose  entry  is  controlled  by  electronic  passwords  rather  than  by  physical 
barriers  are  vulnerable  to  penetration,  misuse,  and  perhaps  disruption. 

Physical  barriers,  of  course,  are  not  an  absolute  bar  to  physical  penetra¬ 
tion  by  stealth  or  force.  The  physical  vulnerability  of  some  control  systems, 
like  the  control  room  of  a  nuclear  reactor,  may  suggest  a  need  for  a  remotely 
sited  duplicate  control  room  to  be  used  if  the  first  one  is  taken  over  (a  pro¬ 
posal  already  rejected  by  the  NRC,  though  some  alternative  control  equipment 
for  basic  shutdown  functions  is  provided).  But  such  duplication  also  increases 
vulnerability  to  capture,  or  simply  to  interception  and  misuse  of  the  communi¬ 
cations  channels,  as  in  computer  and  telephone  networks  today.  False  control 
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signals  can  then  be  combated  by  encoding,  but  this  increases  operational  delays 
and  errors:  recall  the  37  minutes  it  took  for  a  technician  to  find  the  "all 
clear"  tape  after  accidentally  broadcasting  a  tape  announcing  a  Soviet  nuclear 
attack  [Dumas  1 980 : 1 8 f ] .  In  this  game  of  threat  and  countermeasure,  problems 
simply  cascade:  the  design  principle  seems  to  be  "One  damned  thing  leads  to 
another"  (a  theorem  familiar  to  nuclear  designers  who  find  many  accidents 
arising  from  safety  systems’  failing  or  interfering  with  each  other).  To  the 
extent  that  deliberate  intervention  in  a  control  system  can  be  combated,  it  is 
seldom  by  adding  yet  more  layers  of  complexity,  but  by  a  quite  different 
strategy  of  resilient  design  (Chapter  4). 

The  vulnerability  of  controls  is  especially  marked  in  computerized  finan¬ 
cial  systems.  An  adversary  could  probably  crash  the  U.S.  (and  international) 
banking  system  simply  by  using  electronic  funds  transfer  (EFT)  to  make  many 
billions  of  dollars  vanish  instantaneously.  In  1980,  four  13-year-olds  brought 
chaos  to  some  Ottawa  commercial  computers  while  playing  with  a  microcomputer  at 
their  New  York  private  school  [Friedman  1980],  Fraud,  sabotage,  and  coercion 
using  EFT  has  already  reached  alarming  (if  largely  unpublicized)  proportions. 

If  a  computerized  embezzlement  is  detected  (many  cannot  be),  that  fact  itself 
is  frequently  an  effective  lever  for  blackmail,  lest  the  victimized  organiza¬ 
tion  lose  public  confidence  or  have  to  pay  higher  insurance  premia.  It  is 
doubtless  encouraging  to  potential  computerized  thieves  that  of  the  few  caught 
so  far,  most  have  been  rewarded  with  lucrative  jobs  as  security  consultants. 

1.3.  The  chain  can  be  more  vulnerable  than  its  weakest  link. 


The  foregoing  survey  of  threats  to  national  security — brief  and  far  from 

comprehensive — is  altogether  too  sanguine,  for  it  has  not  yet  related  potential 

disruptions  to  the  complex  interdependencies  of  the  systems  in  which  they  act. 

As  a  pioneering  study  of  vulnerability  [Dresch  &  Ellis  1966:3]  declared: 

This  study  is  concerned  with  total  vulnerability,  or  more  precisely  with 
the  vulnerability  of  the  totality — the  whole  nation  as  a  social  system.  It 
is  thus  concerned  with  developing  a  methodology  for  assessing  the  chances 
of  this  system  surviving  without  drastic  or  significant  change  in  its 
essential  characteristics,  without  fatal  impairment  of  its  capacity  for 
regenerating  damaged  parts  or  subsystems,  and  without  sustaining  stres¬ 
ses,  tensions,  or  flaws  fatal  to  its  normal  evolution  and  its  normal 
processes  for  adjusting  to  environmental  change.*** 

It  is  conceivable  that  components  or  subsystems  could  be  identified  that 
are  vulnerable  to  attack  and  that  their  loss  would  destroy  the  nation  in 
some  important  sense.  It  also  is  conceivable  that  other  components  might 
be  highly  vulnerable,  but  that  the  system  has  the  clear  capacity  to 
restore  those  components  or  to  get  along  without  them.  The  assessment  of 
vulnerability,  therefore,  cannot  rest  on  a  mechanical  collection  of 
assessments  of  the  vulnerability  of  separate  parts.  [Emphasis  added . ] 
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"Mechanical  collection,"  however,  is  what  most  vulnerability  studies  do.  At 
best,  they  assess  energy  vulnerab il ity  (for  example)  by  concatenat ing  the  indi¬ 
vidual  vulnerabilities  of  fuel  sources,  processing  plants,  storage  and  trans¬ 
mission  and  distribution  facilities,  etc.  But  this  reductionism  ignores  the 
crux  of  the  problem:  interactions,  conb  inat ions ,  feedback  loops,  higher-order 
consequences,  and  links  across  the  system  boundary.  The  complexity  of  these 
links  may  defy  analysis,  though  not  anecdotal  illustration. 

1.3.1.  Common-mode  failures. 

Any  system,  for  example,  is  subject  to  "common-mode"  failure  (p.  146n),  as 
when  several  supposedly  independent  valves  all  fail  for  the  same  reason — perhaps 
because  of  a  common  design  flaw  or  because  they  are  all  exposed  to  conditions  in 
which  they  cannot  survive  or  because  they  all  suffer  a  power  failure.  Common- 
mode  failures  cannot  be  identified  simply  by  cataloguing  individual  failure 
modes  or  probabilities.  In  a  spectacular  example,  the  afterheat  removal  system 
in  the  Oak  Ridge  Research  Reactor  failed  for  several  hours  during  operation  on 
19  Novenber  1969  even  though  it  had  three  identical  channels  backing  each  other 
up  [Epler  1970].  In  each  channel,  there  were  three  separate  operator  errors, 
two  equipment  installation  errors,  and  three  design  errors  (one  of  which  did  not 
affect  the  outcome  because  the  circuit  in  which  it  occurred  was  inoperable  for 
other  reasons).  The  system  would  have  worked  if  any  one  of  these  21  failures 
(seven  identical  errors  or  equipment  failures  in  each  of  three  channels)  had  not 
occurred.  "This  is  almost  unbelievable,  especially  in  view  of  the  importance 
that  is  attached  to  the  single-failure  criterion  wherein  no  single  failure  shall 
prevent  proper  [operat ion] . . . .***1 t  must  be  concluded  that  present  tools  and 
methods  are  ineffective  in  uncovering  the  source  of  common  mode  failure .... (Re¬ 
liability  analysis  would  have  uncovered  nothing.  The  single-failure  analysis 
would  also  have  been  ineffective."  [id.]  Damage  to  the  core  was  prevented  only 
because  a  less  reliable  backup  system,  which  the  failed  ones  had  replaced, 
happened  still  to  be  available  and  functioning. 

The  causes  of  other  common-mode  nuclear  safety  failures  are  legion.  In  one 
memorable  case,  a  technician  adjusting  the  trip  points  in  several  supposedly 
independent  safety  channels  happened  to  calibrate  them  all  to  an  inoperable 
range  simply  by  setting  his  voltmeter  selector  switch  on  the  wrong  decade 
position.  In  another  case,  a  key  circuit  failed  because  a  test  procedure  simul¬ 
taneously  destroyed  a  diode  and  confirmed  that  it  was  in  good  order.  A  popular 
sampler  anthologized  from  official  reports  of  such  incidents  [Pollard  1 979 J 
notes  common-mode  failures  from  such  diverse  sources  as  power-supply  outage 
[ id . : 1 7 ] ,  disabling  of  four  power  sources  when  a  failed  transformer  hurled 
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a  lead  across  a  69-kV  bus  [:28],  incorrect  installation  [:30]  or  manufacture 
[:70,70,73],  cold  solder  joints  [:48,65],  floats  that  leaked,  filled  up,  and 
sank  I  : 5 0 ]  ,  wiring  errors  copied  onto  wiring  diagrams  [  : 5 1  ]  ,  water  damage  from 
outside  component  storage  [  : 5 7 ]  ,  contaminated  lubricating  oil  (:61],  clogged 
pump  inlet  strainers  (  :62]  ,  pipes  frozen  by  the  failure  of  a  miswired  heater 
thermostat  ( :63]  ,  and  unknown  causes  [  :  1 1  ]  .  In  one  instance,  control  rods 
moved  out  when  comnanded  to  move  either  in  or  out  [  :  1 7 ]  because  the  two-phase, 
three-wire  drive  motor,  after  one  wire  became  d i sconnected ,  could  start  up  on 
the  remaining  phase — supposedly  an  impossibility — owing  to  an  interaction  with 
the  windings  of  a  cooling-blower  motor  wired  in  parallel  with  the  drive  motor. 

In  another  case  [  : 2 2 ]  ,  relays  designed  to  be  fail-safe,  opening  if  their  power 
failed,  stuck  shut  because  of  sticky  paint:  similar  relays  had  proven  highly 
reliable  for  30  years,  but  new  staff  at  the  manufacturer's  new  plant  had  put 
the  paint  on  thicker. 

2.3.2.  Unpredictable  interact  ions . 

The  sheer  complexity  of  many  technical  systems  can  defeat  efforts  to  pre¬ 
dict  their  failure  modes.  "The  sequence  of  human  and  mechanical  events  leading 
to  the  two  most  serious  power  reactor  failures  in  the  U.S.  [at  Browns  Ferry 
and  Three  Mile  Island]  were  excluded  from  fault  tree  analysis  in  the  most  com¬ 
prehensive  study  of  reactor  safety  ever  undertaken  [Rasmussen  et  al.,  NRC  1975]. 
Clearly  it  is  possible  to  construct  systems  sufficiently  complex  that  all  prob¬ 
able  states  of  the  system  are  not  foreseeable,"  [Hoover  1979:53]  A  29-cent 
switch  burned  out  by  improper  testing  caused  grotesque  failures  to  cascade 
throughout  the  Apollo  13  spacecraft  [Cooper  1973].  In  1981),  as  simple  an  ini¬ 
tiating  event  as  dropping  a  wrench  socket  down  an  Arkansas  missile  silo  led  to 
the  explosive  ejection  of  a  megaton-range  Titan  warhead  into  a  nearby  field. 

The  complexity  of  even  the  most  advanced  technical  systems,  however,  is 
dwarfed  by  that  of  biological  and  social  systems,  as  a  simple  example  illus¬ 
trates  [Holling  &  Goldberg  1971:222],  The  World  Health  Organization  attacked 
malaria-carrying  mosquitos  among  the  inland  Dayak  people  of  Borneo  with  verve 
and  abundant  DDT.  The  people  became  much  healthier,  but  their  roofs  started 
falling  down.  The  DDT  had  killed  a  parasitic  wasp  which  had  previously  con¬ 
trolled  thatch-eating  caterpillars.  Worse,  the  cats  then  started  to  die:  they 
had  built  up  lethal  doses  of  DDT  by  eating  geckos  which  had  eaten  poisoned 
caterpi 1 lars .  Without  the  cats,  rats  flourished.  Faced  with  sylvatic  plague, 
the  WHO  had  to  parachute  cats  into  Borneo.  "We  cite  this  example,"  the  authors 
remark,  "not  because  it  has  great  substance,  but .. .because  it  shows  the  variety 
of  interactive  pathways  that  link  parts  of  an  ecological  system,  pathways... 


[so]  i nt ri cate ...  that  manipulating  one  fragment  causes  a  reverberation 
throughout...."  [id.] 

A  further  example  (  id.  :223]  extends  the  concept  .  Farmers  in  the  Cafiete 
Valley  on  the  coast  of  Peru  shifted  in  the  1920s  from  sugar  cane  to  cotton. 

This  developed  an  economically  tolerable  infestation  by  seven  native  insect 
pests.  In  1949,  persistent,  highly  toxic,  broad-spectrum  pesticides,  such  as 
DDT  and  toxaphene,  because  cheaply  available  for  distribution  by  aircraft 
throughout  the  confined  valley,  offering  an  opportunity  to  decrease  crop  damage 
dramatically  and  hence  increase  yields  and  profits.  That  initial  result  was 
followed  within  a  few  years,  however,  by  the  emergence  of  six  new  cotton  pests 
that  had  not  previously  been  a  problem;  then,  six  years  later,  by  the  return  of 
the  original  seven  pests,  now  equipped  with  pesticide  resistance.  Despite 
heavier  and  more  frequent  spraying  and  the  use  of  organophosphorus  insecti¬ 
cides,  "the  cotton  yield  plummeted  to  well  below  yields  experienced  before  the 
synthetic  pesticide  period.  The  average  yield  in  1956  was  the  lowest  in  more 
than  a  decade,  and  the  costs  of  control  were  the  highest."  The  near-bankrupt 
farmers  were  forced  into  a  sophisticated  program  of  integrated  pest  management 
based  on  reformed  farming  practices,  minimal  use  of  biocides,  and  fostering  of 
beneficial  insects.  As  any  ecologist  might  predict,  once  biological  balance 
was  restored,  pest  levels  dwindled  and  yields  increased  to  the  highest  levels 
in  the  valley's  history.  This  is,  however,  a  story  of  luck.  The  farmers  might 
well  have  caused  irreversible  damage:  their  effort  to  achieve  a  narrowly 
defined  objective  (eliminating  seven  insect  pests)  in  the  cheapest  and  simplest 
way  had  generated  "a  series  of  unexpected  and  disastrous  consequences  explicit¬ 
ly  because  of  the  narrow  definition  of  the  objective  and  the  intervention." 

The  Borneo  and  Canete  examples,  Hoi  ling  and  Goldberg  note  [id.:224],  "il¬ 
lustrate  four  essential  properties  of  ecological  [or  other  complex]  systems": 

By  encompassing  many  components  with  complex  feedback  interactions  between 
them,  they  exhibit  a  systems  property.  By  responding  not  just  to  present 
events  but  to  past  ones  as  well,  they  show  an  hi stor  ical  quality.  By  re¬ 
sponding  to  events  at  more  than  one  point  in  space,  they  show  a  spat ial 
interlocking  property,  and  through  the  appearance  of  lags,  thresholds,  and 
limits  they  present  distinctive  non-1 inear  structural  propert ies. . . . [E]co- 
systems  are  characterized  not  only  by  their  parts  but  also  by  the  interac¬ 
tion  among  these  parts.  It  is  because  of  the  complexity  of  the  interac¬ 
tions  that  it  is  so  dangerous  to  take  a  fragmented  view,  to  look  at  an 
isolated  piece  of  the  system.  By  concentrating  on  one  fragment  and  trying 
to  optimize  the  performance  of  that  fragment,  we  find  that  the  rest  of  the 
system  responds  in  unexpected  ways. 

By  applying  these  biological  insights  (Chapter  4)  to  urban  renewal,  rent  con¬ 
trol,  and  freeway  construction,  Holling  and  Goldberg  [_i_d_.  : 2 27*228]  were  even 
able  to  predict  and  explain  results  that  had  long  baffled  analysts  of  urban 
socioeconomics. 


L 


l 


19 


These  properties  of  natural  and  social  systems — properties  derived  from 
their  very  complexity — are  precisely  those  that  are  critical,  as  Brown  [1977a] 
argued  above,  to  the  conceptual  basis  of  effective  preparedness.  Viewing 
security  as  solely  an  outgrowth  of  military  strength  (whose  impact  is  as  narrow 
and  double-edged  as  that  of  the  Canete  Valley  pesticides)  dangerously  neglects 
the  effect  of  economic,  ecological,  and  social  disturbances  on  the  very  systems 
one  is  seeking  to  secure.  Focusing  on  one  aspect  of  security  at  a  time  ignores 
the  interactions  among  all  aspects.  Subtle,  higher-order  interactions  can  be  a 
greater  threat  than  direct,  first-order  consequences . 

Where  cause-effect  relationships  are  too  complex  to  understand  intuitive¬ 
ly,  attempted  solutions  can  make  the  national  security  problem,  or  other  prob¬ 
lems,  worse:  the  cause  of  problems  is  often  prior  solutions.  Some  systems 
analysts,  such  as  the  mathematician  Roberto  Vacca  [1974],  believe  that  poorly 
understood  interactions  may  prove  collectively  so  unmanageable  as  to  lead  to 
the  breakdown  of  industrial  society.  The  Swedish  vulnerability  study  [Wentzel 
1979:2],  citing  this  view,  found  "similar  apprehensions  among  technicians, 
biologists  and  sociologists."  Perhaps  an  extended  qualitative  illustration 
[Lovins  1977b: 10—1 1 1  can  convey  the  flavor  of  these  unexpected  interactions, 
feedback  loops,  and  potential  instabilities  in  modern  techno-economic  systems 
and  how  they  bear  on  energy  preparedness.  The  following  example  is  of  course 
highly  selective,  but  is  not  a  wholly  tongue-in-cheek  description  cf  recent  treids. 

1.3.3.  Tracing  higher-order  consequences. 

The  United  States  pursued  for  many  years  a  policy  of  promoting  the  use  of 
more  energy  while  holding  its  price  down  through  regulation  and  subsidy.  Be¬ 
cause  the  energy  looked  cheap,  its  users  did  not  know  how  much  was  enough,  and 
grossly  underinvested  in  energy  productivity.  The  resulting  emergence  of  the 
United  States  as  a  massive  net  importer  in  the  world  oil  market  harmed  many 
U.S.  allies.  It  harmed  the  economies  of  some  oil-exporting  countries  which 
were  being  asked  to  lift  oil  at  a  rate  detrimental  to  their  reservoirs  or  eco¬ 
nomies  or  both.  It  devastated  the  Third  World,  which  was  unable  to  compete  for 
the  oil.  The  value  of  the  dollar  fell.  Dollai — denominated  oil  prices  rose. 

The  U.S.  then  needed  even  more  foreign  exchange  to  pay  for  the  oil.  It  earned 
this  in  three  main  ways:  depleting  domestic  stocks  of  conmodities  (which  was 
inflationary,  left  the  forests  looking  moth-eaten,  and  left  holes  in  the  ground 
where  orebodies  used  to  be);  exporting  weapons  (which  was  in f lat i onary ,  destab¬ 
ilizing,  and  of  controversial  morality);  and  exporting  wheat  and  soybeans 
(which  inverted  Midwestern  real-estate  markets  and  probably  raised  domestic 
food  prices).  Exported  American  wheat,  until  embargoed,  diverted  Soviet 
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capital  from  agriculture  to  military  activities,  increasing  pressure  on  the 
U.S.  to  raise  its  own  [inflationary]  defense  budget — which  it  had  to  do  anyhow 
to  defend  the  sea-lanes  to  bring  in  the  oil  and  to  defend  the  Israelis  from  the 
arms  sold  to  the  oil-exporting  Arabs.  (From  this  point  of  view,  the  best  form 
of  Middle  Eastern  arms  control  might  be  American  roof  insulation.) 

With  crop  exports  crucial  to  the  balance  of  payments,  pressure  mounted  for 
even  more  capital-,  energy-,  and  water-intensive  agribusiness.  Fencerow-to- 
fencerow  planting  and  cultivation  of  steep  and  marginal  land  raised  soil-loss 
rates  to  levels  exceeding  to  those  of  the  Dust  Bowl,  with  a  dumpt ruck-1 oad  of 
topsoil  passing  New  Orleans  in  the  Mississippi  River  each  second — not  counting 
soil  that  was  compacted,  burned  out,  or  sterilized.  Heavy  chemical  inputs  and 
a  severely  narrowed  genetic  base  impaired  free  natural  life-support  systems. 
Still  more  oil  was  needed  for  fertilizers,  pesticides,  herbicides,  irrigation, 
and  desalination.  All  of  thes"  increased  the  stress  on  remaining  natural 
systems  and  threatened  uncontrollable  epidemics  of  crop  pests  with  an  evolved 
resistance  to  chemical  pesticides.  More  energy  was  needed  to  pump  the  vanish¬ 
ing  groundwater  from  greater  depths  and  to  purify  dr inking-water  contaminated 
with  nitrate  runoff.  More  coal  strip-mines  and  power  plants,  using  still  more 
water  and  land,  were  needed  to  supply  the  energy.  The  capital  intensity  of 
modern  agribusiness,  coupled  with  fluctuations  in  markets  and  weather,  became 
unsustainable  in  the  1980  recession  when  land  values  (on  whose  inflation 
farmers  had  borrowed  heavily  to  pay  their  carrying  charges)  stopped  inflating, 
instantly  creating  thousands  of  mini-Chryslers  out  of  Midwestern  farms. 

The  spiral  sped  faster  as  artificial  financial  incentives  demanded  quicker 
returns.  The  Ogallala  Aquifer  under  the  High  Plains  was  drawn  down  one  to 
three  meters  per  year  and  recharged  less  than  a  centimeter  per  year.  It  was 
already  half  gone  when  the  lifting  rate,  during  the  four  dry  months  of  the 
year,  surpassed  the  full  annual  flow  of  the  Colorado  River  past  Lee's  Ferry. 
Two-fifths  of  America's  feedlot  cattle  came  to  be  grown  on  grains  made  of 
Ogallala  groundwater.  Growing  enough  of  that  grain  to  put  enough  weight  on  a 
feedlot  steer  to  put  an  extra  one  pound  of  meat  on  the  table  came  to  consume 
about  a  hundred  pounds  of  lost,  eroded  topsoil  and  over  eight  thousand  pounds 
of  mined,  unrecharged  groundwater  [Jackson  1980;  Jackson  &  Bender  1981].  To 
replace  imported  oil,  some  people  started  to  make  the  corn  into  ethanol  fuel, 
but  because  of  the  unsustainable  farming  practices,  each  bushel  of  corn 
consumed  about  two  bushels  of  topsoil  [id.]. 

Meanwhile,  excessive  substitution  of  apparently  cheap  inanimate  labor 
exacerbated  structural  unemployment.  A  tax  system  left  over  from  an  era  of 
plentiful  capital  and  scarce  labor,  and  therefore  designed  to  subsidize  capital 
investment  and  tax  employment,  also  increased  unemployment.  This  worsened 


poverty  and  inequity,  which  increased  alienation  and  crime.  High  oil  prices 
and  the  collapse  of  the  automobile  industry  hastened  the  decay  of  the  urban 
Northeast.  Priorities  in  crime  control  and  health  care  were  stalled  in  part  by 
the  heavy  capital  demands  of  building  and  subsidizing  the  energy  sector,  which 
itself — by  its  extraordinary  capi t al- intens i t y  and  its  noxious  emissions — con¬ 
tributed  to  the  unemployment  and  illness  at  which  those  investments  were  aimed. 
Energy  prices  and  oil  balance-of-payment s  deficits  helped  to  drive  inflation. 
Inflation  ano  unemployment  fed  civil  unrest.  The  growing  vulnerability  of  the 
energy  system  to  strikes,  sabotage,  and  protest  required  greater  guarding,  sur¬ 
veillance,  and  erosion  of  civil  liberties.  These  encouraged  the  beginnings  of 
a  drift  towards  a  garrison  state.  This  drift,  coupled  with  consolidation  of 
oil  and  uranium  cartels  and  a  widespread  failure  to  address  the  energy  security 
needs  of  developing  countries  hit  hardest  by  oil  prices,  encouraged  interna¬ 
tional  distrust  and  domestic  dissent,  feeding  further  suspicion  and  repression. 

On  the  horizon  loomed  energy-related  climatic  shifts  that  could  jeopardize  ag¬ 
riculture,  especially  in  the  Midwestern  breadbasket,  so  endangering  a  hungry 
globe.  The  competitive  export  of  arms,  reactors,  and  inflation  from  rich  to 
poor  countries  made  the  world  more  inequitable,  tense,  and  anarchic.  Plans 
proceeded  to  create,  within  a  few  decades,  an  annual  flow  of  tens  of  thousands 
of  bombs'  worth  of  plutonium  as  an  item  of  commerce  within  the  same  interna¬ 
tional  community  that  had  never  been  able  to  stop  the  heroin  traffic.  Nuclear 
bomb  capabilities  crept  towards  the  Persian  Gulf  from  several  directions. 

All  this  is  rather  a  lot,  of  course,  to  blame  on  underpriced  energy.  But 
the  point  of  this  informal,  slightly  whimsical  tracing  of  some  possible  conse¬ 
quences  is  that  the  elements  of  national  security  must  be  considered  as  an 
interdependent  whole.  Their  bizarrely  intricate  connections  keep  on  working 
whether  we  perceive  them  or  not. 

1.4.  Surprises. 

We  do  not  yet  have,  and  may  not  have  for  a  very  long  time  if  ever,  all  the 
information  we  need  to  foresee  all  important  consequences  of  our  actions. 

This  does  not  mean  that  we  dare  not  do  anything.  It  does  mean  that  we  need  to 
view  any  reductionist  cata’ogue  of  national  security  concerns  with  a  certain 
wariness  and  humility,  knowing  that  it  cannot  capture  the  range  of  surprises 
from  without,  or  the  higher-order  interactions  within,  that  together  almost 
certainly  dominate  total  risk. 

In  1974,  one  of  us  (ABL)  made  a  list  of  the  twenty  most  likply  surprises 
in  energy  policy  over  the  next  decade  or  two.  Near  the  top  of  the  list  were  "a 
major  reactor  accident"  and  "a  revolution  in  Iran."  Number  twenty  on  the  list,  of 
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which  no  examples  could  be  given,  was  "surprises  we  haven't  thought  of  yet." 
There  will  be  many  of  those,  not  only  because  there  is  so  much  still  unknown 
about  how  the  world  works,  but  because  rare  events  do  happen.  A  principle 
enunciated  by  George  Orwell  and  E.  B.  White,  and  known  to  discomfited  experi¬ 
mental  scientists  as  the  Totalitarian  Law  of  Physics,  states  that  "Whatever  is 
not  forbidden  [by  the  laws  of  physics]  is  compulsory" — it  will  happen  sooner  or 
later.  There  are  many  possible  events  which  may  be  individually  very  rare: 
their  probability  may  be  vanishingly  small.  But  these  surprises  are  also 
almost  infinitely  numerous,  so  they  will  catch  up  with  us,  and  one  or  another 
of  them  is  likely  to  occur  fairly  frequently.  We  live  in  a  world  full  of  nasty 
surprises,  and  had  better  prepare  for  it. 

National  security,  therefore,  requires  not  only  that  we  calculate  the 
probability  of  foreseeable  kinds  of  failure,  but  also  that  our  designs  include 
the  broader  philosophy  of  resilience  in  the  face  of  the  incalculable:  lunatics, 
guerrillas,  Middle  East  wars,  freak  winters,  social  turmoil,  unpredicted  high- 
technology  failures.  True  preparedness  requires  not  merely  an  explicit 
readiness  for  foreseeable  threats — the  subject  of  the  next  two  chapters — but 
also  an  implicit  readiness  for  unforeseeable  and  imponderable  threats.  The 
theme  of  unforeseeable  threats  to  complex,  interactive  systems,  and  the  design 
principles  for  resilience  that  flow  from  the  inevitability  of  such  threats, 
will  return  for  full  development  starting  in  Chapter  4. 
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2.  GENERAL  VULNERABILITIES  OF  THE  U.S.  ENERGY  SYSTEM 


2.1.  What  makes  the  energy  system  vulnerable? 

Most  consnerc i a  1  fuels  and  power  in  the  United  States  today  are  delivered 
by  processing  and  upgrading  fossil  fuels  in  relatively  remote,  centralized 
plants,  then  distributing  the  concentrated,  high-quality  product  via  elaborate 
transmission  networks  to  dispersed  users.  These  processes  depend  on  massive, 
highly  capi tal-intensive,  long-lead-time  facilities  of  high  technical  and 
social  complexity,  operating  continuously  under  precise  controls. 

The  familiarity  and  usual  dependability  of  this  system  encourage  a  belief 
that  it  will  continue  to  resist  disruption  in  the  future.  But  the  purpose  of 
vulnerability  analysis  is  to  ensure  preparedness,  not  necessarily  to  defend  the 
status  quo.  In  fact,  as  we  shall  show,  the  very  properties  of  the  modern 
energy  system  that  make  it  such  a  visible  and  impressive  technical  achievement 
also  make  it  peculiarly  vulnerable  to  the  threats  described  in  the  previous 
Chapter.  Each  property  just  listed  contributes  to  this  latent  vulnerability  in 
ways  we  shall  now  describe  under  the  following  topics:  dangerous  materials, 
limited  public  acceptance,  centralization  of  supplies,  large  haul  lengths, 
limited  substitutability,  unique  characteristics  of  grid  electricity,  inflexi¬ 
bility  of  delivery  systems,  high  capital  intensity,  long  lead  times,  special¬ 
ized  labor  requirements,  control  problems,  and  possible  adaptability  of  fuel 
delivery  systems  to  delivering  other  substances  instead.  Chapter  3  will  apply 
this  generic  discussion  to  some  specific  energy  technologies;  first,  selected 
examples  will  illuminate  the  structural  properties  of  the  energy  system. 

2.1.1.  Dangerous  materials. 

Many  of  the  forms  in  which  energy  is  commonly  delivered  are  hazardous  in 
their  own  right.  Though  accidental  electrocution  is  uncommon,  defective  elec¬ 
tric  wiring  is  among  the  leading  causes  of  fires  (with  poorly  installed  and 
maintained  wood  stoves  gaining  on  it  fast).  But  the  main  danger  arises  from 
the  deliberately  high  energy  density  of  fuels — the  energy  carriers  which,  by 
direct  combustion,  supply  87%  of  U.S.  delivered  energy.  A  gallon  of  average 
gasoline,  for  example,  contains  as  much  energy  as  a  strong  horse  produces  in  49 
hours'  work.  A  standard  gasoline  pump  (say  50  liters  per  minute)  delivers  fuel 
energy  at  the  remarkable  rate  of  29  thermal  megawatts;  thus  a  20-pump  station, 
when  all  its  pumps  are  working,  is  delivering  energy  about  as  fast  as  a  600-MWe 
power  station  (Foley  1979). 
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Such  fuels  are,  by  intent,  highly  flammable  or  explosive.  The  amounts  of 
fuels  present  even  in  their  most  dispersed  stages  of  distribution,  such  as  tank 
trucks,  are  sizable  hazards.  A  9000-gallon  tank  truck  of  #2  fuel  oil  contains 
the  energy  equivalent  of  a  small  (0.3  kT)  nuclear  explosion  (although  if  it 
burned,  the  energy  would  appear  not  as  prompt  radiation  or  blast  but  as  radiant 
hear  sufficient  to  melt  nearby  cars).  In  refinery  accidents,  burning  oil  flows 
have  covered  as  much  as  17  hectares — an  essentially  unext ingui shable  conflagra¬ 
tion — and  vapor  explosions  have  devastated  as  much  as  12  hectares  [Stephens 
1970:69,96],  The  hazard  is  not  limited  to  petroleum-derived  fuels:  at  least 
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one  worker  was  killed  in  the  6  March  1981  explosion  of  a  680-m  ethanol 
tank  in  Sao  Paulo,  Brazil  [Los  Angeles  Times  1981b]. 

Gaseous  fuels,  being  harder  to  contain,  increase  the  hazard:  "With  vast 
quantities  of  a  highly  explosive  substance  [natural  gas]  being  carried  at  very 
high  pressures  in  a  steel  pipeline  with  a  wall  thickness  ranging  from  1/10"  to 
1/2",  often  near  or  through  populated  areas,  the  potential  for  catastrophe  is 
considerable."  [Congressional  Research  Service  1977:1:13]  "A  gas  pipeline  can 
be  bombed  over  a  considerable  length  by  a  single  charge.  It  will  blow  up  by 
itself  if  a  break  allows  air  into  the  line.  An  air-gas  mixture,  under  [the] 
right  conditions,  can  explode  and  detonate  over  miles  of  terrain,  through 
cities  and  industrial  centers ...  .The  writer  observed  an  8-inch  spiral  weld  line 
that  unwound  and  came  out  of  its  ditch  for  a  distance  of  8  miles.  A  larger 
line  would  result  in  a  worse  situation.  Detonation  can  occur  even  in  a  2-inch 
line."  [Stephens  1973:34-35]  Compared  to,  say,  piped  water,  this  is  an  im¬ 
pressive  potential  for  mischief,  demanding  meticulous  care.  Such  energy  densi¬ 
ty  increases  the  likelihood  of  serious  consequences  from  an  initial  disruption, 
whether  from  natural  disaster,  deliberate  attack,  or  technical  failure.  The 
ready  availability  of  such  materials  as  natural  gas,  propane,  and  gasoline  also 
expands  the  destructive  capability  of  terrorists  by  making  it  relatively  simple 
for  them  to  improvise  fuel-air  explosives  whose  detonation  inside  major, 
heavily  reinforced  structures  can  demolish  them. 

Another  manifestation  of  high  energy  density  is  the  rad i oact • vi ty  of 
nuclear  materials.  Pure  fissionable  materials  have  over  a  million  times  the 
energy  per  unit  volume  of  pure  hydrocarbon  fuels.  They  are  mildly  radioactive; 
many  of  their  fission  and  activation  products,  intensely  so.  Despite  extensive 
precautions,  the  possibility  remains  of  accidental  or  deliberate  releases;  and 
since  the  threat  is  insensible  and  can  have  long-term  consequences  with  high 
emotional  impact,  even  the  possibility  of  a  minor  release  can  have  major  social 
effects.  "More  than  any  other  type  of  peacetime  d i saster ,... nuclear  emergen¬ 
cies  could  cause  mass  panic .... [T]he  prime  danger  comes... from  the  [wide]  dis- 


persal  of  radioactive  material..,,  impossible  to  detect  without  special  instru¬ 
ments,  (and  which]  could  cause  fearsome  and  unpredictable  consequences :  cancer, 
sterility,  and  gross  birth  de fects . . . for  many  years  af ter.  .  .release  ."  [Joint 
Committee  on  Defense  Production  1977:1:29]  Since  many  of  these  effects  are 
i nd i st ingu ishable  (even  statistically)  from  those  arising  from  other  causes, 
the  perpetrators  of  a  release  can  be  blamed  for  far  more  harm  than  they  did; 
conversely,  people  cannot  be  sure  the  release  was  not  the  cause  of  their  af¬ 
fliction,  and  actual  victims  may  be  unable  to  prove  causality  as  a  basis  for 
just  compensation.  These  perplexing  issues,  now  being  raised  in  class  actions 
by  persons  exposed  to  the  Three  Mile  Island  releases  and  to  fallout  from 
military  nuclear  weapons  tests  in  the  1950s,  have  aroused  considerable  public 
attention  and  anxiety.^ 

2.1.2.  Limited  public  acceptance. 

Such  anxiety  is  only  one  of  many  sources  of  broadly  based,  ideologically 
diverse  reluctance  to  bear  the  social  costs  of  major  energy  facilities.  The 
sources  of  opposition  include  a  desire  to  preserve  a  particular  way  of  life 
(an  important  issue  in  rural  Western  areas  threatened  with  boom-town  develop¬ 
ment);  concern  about  a  wide  range  of  environmental  impacts  (water  use,  loss  of 
habitat  or  endangered  species,  biomedical  effects  of  electric  fields  from  high- 
voltage  transmission  lines,  safety  of  LNG  or  nuclear  plants,  oil  pollution, 
nuclear  proliferation,  noise,  coal  dust,  heat  releases,  esthetics,  etc.); 
desire  to  defend  certain  social  structures  or  values  (free  enterprise,  small 
business,  local  self-reliance,  etc.);  or  even  perceived  vulnerability  itself. 

It  does  not  matter  here  how  far  these  diverse  concerns  are  justified  or  how 
widely  they  are  shared;  the  important  thing  is  that  they  represent  views  sin¬ 
cerely  and  strongly  held  by  citizens  of  a  democracy  who  believe  they  are 
entitled  to  give  their  views  political  and  practical  effect.  Many  historical 
examples  suggest  [Lovins  1979,1980a]  that  efforts  to  bypass  or  suppress  such 
concerns  bear  high  political  costs  and  often  turn  out  in  hindsight  to  represent 
a  refusal  to  listen  to  advance  warnings  of  serious  errors  in  policy.  For 
present  purposes,  however,  it  is  sufficient  to  note  that  major  energy  facili¬ 
ties  of  any  kind — like  highways,  water  projects,  chemical  factories,  toxic- 
waste  dumps,  etc. — can  come  to  represent  to  many  people  a  highly  visible  focus 
for  both  project-specific  and  broader  grievances.  By  threatening  direct  and 
undesired  impacts,  by  embodying  social  diseconomies  of  scale  (Chapter  5),  or  by 
symbolizing  other  perceived  inequities,  such  a  facility  can  be,  from  the  stand¬ 
point  of  civil  di sturbances ,  an  attractive  nuisance*.  Nuclear  facilities, 

*And  can  have  troublesome  civil— liberties  implications  (see  references,  p.  62). 
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besides  their  technical  vulnerability  (Chapter  3),  are  clearly  among  the  irost 
prominent  lightning-rods  for  such  social  tensions  [Foley  &  Ltinnroth  1981:25]: 
hence  several  studies,  e.g.  by  Bass  et  al .  [1980],  on  the  potential  for  crimin¬ 
al  acts  against  nuclear  power  programs  motivated  partly  by  opposition  to  them. 

2.1.3.  Centralization  of  supplies. 

The  geographic  separation  of  primary  energy  sources  (oil  and  gas  fields, 
coal  mines,  dams,  etc.)  or  of  conversion  facilities  (refineries,  power  plants, 
etc.)  from  final  users  has  two  obvious  physical  results:  it  concentrates  the 
facilities  themselves  into  a  small  area,  more  vulnerable  to  all  sorts  of  dis¬ 
ruptions,  and  it  makes  the  connecting  links  longer  and  hence  more  tenuous  (as 
quantified  below).  But  a  more  subtle  social  result  of  this  separation  may  be 
equally  important:  the  automatic  allocation  of  the  delivered  energy  and  of  its 
side-effects  or  social  costs  to  different  groups  of  people  at  opposite  ends  of 
the  transmission  lines,  pipelines,  and  rail  lines.  This  divorce  of  costs  and 
benefits  is  considered  admirable  at  one  end  but,  often,  unjust  at  the  other. 

To  put  it  baldly,  politically  weak  rural  people  do  not  want  to  live  in  "zones 
of  national  sacrifice"  for  the  benefit  of  "slurbians"  a  thousand  miles  away. 

Further,  the  very  scale  and  complexity  of  most  modern  energy  projects 
tends  to  organize  their  planners  and  builders  into  particular  patterns  which 
may  be,  or  at  least  appear  to  be,  remote  and  unresponsive  to  local  needs.  These 
trends  have  together  led  in  the  United  States  to  more  than  sixty  "energy  wars" 
— violent  or  near-violent  siting  conflicts — now  in  progress.  They  reflect  an 
intensity  and  breadth  of  social  unrest  that  any  student  of  energy  vulnerabili¬ 
ties  nust  take  seriously.  Archetypical,  perhaps,  is  the  long-running  rebellion 
(Casper  &  Welistone  1981]  by  politically  conservative  farmers  in  northern  Min¬ 
nesota  who  nightly  dismantle  high-voltage  power  lines  that  have  been  built  dia¬ 
gonally  across  their  land  through  a  political  process  that  they  consider  unjust 
and  illegit imate.  An  anthropologist  who  has  named,  analyzed,  and  often  succes¬ 
sfully  predicted  the  course  of  this  and  other  "energy  wars"  [Gerlach  1979; 
Gerlach  &  Radcliffe  1979]  persuasively  argues  that  they  often  reflect  an  under¬ 
lying  conflict  between  a  network  and  a  hierarchy;  the  network  generally  wins. 

Additional  social  feedback  loops  can  further  heighten  the  risk  that  social 
unrest  will  spill  over  into  deliberate  disruption  of  energy  systems.  For  exam¬ 
ple,  the  economic  insecurity  or  inequity  that  massive  energy  projects  may  bring 
to  both  ends  of  their  distribution  systems  tends  to  increase  tension  and  con¬ 
flict.  The  perceived  risk  and  social  unattractiveness  of  the  projects  and  the 
difficulty  of  siting  and  guarding  large  nunbers  of  plants  may  in  turn  heighten 
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pressures  for  turther  centralization  in  remote,  parami 1 i t ar i zed  enclaves  like 
"nuclear  parks"  [Burwell  et  al  .  1979;  Nuclear  Regulatory  Commission  1976b j, 
built  perhaps  on  the  energy  scale  of  the  Mideast  oilfields  I  1 1ASA  1981]  —  the 
same  scale  whose  vulnerability  had  been  the  rationale  for  nuclear  power. 

2.1.4.  Long  haul  distances. 

Most  energy  sources  in  the  United  States  have  become  far  more  centralized 
than  their  customers.  The  distribution  distances  required  by  this  disparity 
can  be  roughly  quantified.  For  exanple,  a  1-GWe  (1000-MWe)  power  station 
occupying  a  site  of  about  10  sq  km,  including  the  area  of  its  coal  depot  or 
nuclear  exclusion  zone,  represents  a  source  whose  power  density  (1  kWe/m^) 
is  four  to  five  orders  of  magnitude  (factors  of  ten)  greater  than  the  average 
density  of  electricity  consumption  [Baughman  &  Bottaro  1976;  p . 1 6 7 ] .  That  aver¬ 
age  density  use  corresponds  to  an  average  service  radius,  for  a  1-GWe  plant,  of 
about  150  km  (90  miles).  In  fact,  for  a  marginal  plant  of  about  1  GWe  capaci¬ 
ty,  the  actual  average  haul  length  is  about  350  km  (220  miles)  in  the  United 
States,  or  about  100  km  (60  miles)  in  the  denser  grids  of  Western  Europe.  Some 
electricity  travels  a  far  greater  distance:  British  Colunbia  hydroelect ricity 
goes  as  far  as  Southern  California  and  Arizona,  and  some  Churchill  Falls 
(eastern  Canadian)  hydroelectricity  probably  gets  nearly  to  Florida. 

The  average  barrel  of  oil  lifted  in  the  U.S.  is  transported  a  total  of 
about  965-1290  km  (600-800  miles)  before  final  use  [Energy  &  Defense  Project 
1980:11],  The  average  unit  of  natural  gas  probabLy  moves  even  further.  In 
1974,  662  of  U.S. -mined  coal  was  hauled  an  average  of  485  km  (300  miles)  by 
rail,  and  21% — especially  in  the  Ohio  River  Valley — an  average  of  775  km  (480 
miles)  by  barge  [Congressional  Research  Service  1977:1:62-63,77].  Remote  West¬ 
ern  strip-mining  and  exploitation  of  Arctic  and  offshore  petroleum  resources 
will  considerably  increase  the  average  haul  lengths.  "The  average  distance  we 
have  moved  our  energy  sources  has  continuously  increased...,  and  all  signs 
point  to  an  even  greater  extension  of  these  vital  supply  lines."  [_id.  1:2] 
Longest  of  all — halfway  around  the  world — are  the  supply  lines  for  Mideast  oil. 

These  long  haul  lengths  increase  vulnerability  to  all  the  types  of  hazards 
noted  in  Chapter  1.  Different  fuel  delivery  systems,  of  course,  have  different 
vulnerabilities.  "The  pipeline  network  [in  California]  contains  fewer  parallel 
links  than  the  highway  net,  and  has  less  excess  capacity  for  carrying  fuel. 
Therefore,  it  is  more  vulnerable  to  disruption  by  earthquake.  However,  it  is 
less  vulnerable  to  a  Teamsters’  Union  strike.”  [Glassey  &  Craig  1978:330-331] 

Historical ly ,  the  greatest  concern  about  fuel  and  power  transportation  has 
been  that,  being  outdoors  and  over  long  distances,  "A  large  portion  of  the  fuel 
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movement ... i n  the  United  States  is  vulnerable  to  disruption  from  inclement 
weather,  and  all  forms  of  fuel  shipment  are  subject  to  disruption  by  natural 
disaster."  [Congressional  Research  Service  1977:111:189]  In  the  cold  winter 
of  1976-77,  for  example,  "The  Ohio  River  froze  bank  to  bank[,l  blocking  barge 
traffic  in  both  fuel  oil  and  coal.  Coal  [wetted  at  the  mine  fare  to  suppress 
dust]  froze  solidly  in  rail  cars,  sometimes  requiring  blasting  to  remove  it. 
Winter  snows  impeded  truck  movements  of  heating  oils,  gasoline,  and  LPG."  [id. 
189]  The  seriousness  of  such  effects  depends  on  the  mix  and  flexibility  of 
fuel  use  in  the  area.  For  example,  the  Ohio  River's  freeze  was  especially  dis 
ruptive  because  the  regional  dependence  on  coal  that  made  the  109-day  1978 
miners'  strike  [Ackermann  1979]  so  disruptive  in  the  Midwest  [Subcommittee  on 
Energy  &  Power  1978:17]  coincided  with  a  regional  dependence  of  coal  movements 
on  barges.  "Water  carriers  are,  by  and  large ... .most  subject  to  weather... — 
freezing,  flooding,  and  drought  [which  reduces  allowable  draft  and  constrains 
navigable  channels]  can  all  have  very  disruptive  impacts."  [Congressional 
Research  Service  1977:111:191] 

Slight  differences  in  the  nature  of  the  disruption  can  greatly  change  its 
consequences:  the  winter  of  1977-78,  though  nearly  as  cold  as  1976-77,  caused 
virtually  none  of  its  dislocations  in  fuel  delivery  [Kellogg  A  Schware  1981: 
63],  both  because  the  local  details  of  interference  with  shipments  differed 
and  because  people  were  better  prepared  the  second  time.  But  a  great  variety 
of  circumstances  is  available  to  test  the  energy  system  for  potential  weakness 
es.  For  example  [Quirk  &  Moriarty  1980:90-91]: 

-  The  1976-77  heating  season  had  22%  more  degree-days  (a  measure  of  space 
heating  requirements)  and  was  an  average  of  1.8*C  colder  than  1975-76;  the 
1976-79  heating  seasons  had  15%  more  degree-days  than  1973-76.  (Conversely, 
the  summer  of  1980  was  about  13%  hotter  than  normal.) 

-  The  1975-76  and  1976-77  rainy  seasons  in  California  were  60%  drier  than 
the  1931-77  average. 

-  There  was  a  global  cold  spell  in  1812-17;  in  the  summer  of  1816,  frosts 
were  reported  every  month  in  New  York  and  New  England,  and  Western  Europe  had 
similarly  severe  weather. 

-  In  the  past  70,000  years,  there  may  have  been  several  abrupt  drops  of 
temperature  by  5*C  over  large  areas;  this  may  occur  as  often  as  once  every 
1,000  to  10,000  years. 

Abnormal  weather  affects  both  energy  supplies  and  energy  demands,  giving 
rise  to  unpleasant  second-order  impacts.  This  is  illustrated  by  the  1975-77 
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Western  U.S.  drought  (id.  91-92],  which  reduced  regional  hydroelectric  output 
by  about  40%.  This  deficit  made  hydro-dependent  Pacific  Gas  &  Electric  Company 
burn  an  extra  50  million  barrels  of  oil  and  was  largely  responsible  for  raising 
PG&E's  operating  expenses  by  30%.  Meanwhile,  however,  water  allotments  for 
agriculture — which  normally  uses  85%  of  California's  watei — were  reduced  by 
over  60%,  and  extra  groundwater  pumping  to  try  to  make  good  this  loss  used 
about  1  billion  kW-h  of  additional  electricity.  (in  normal  years,  California's 
largest  single  use  of  electricity  is  pumping  by  the  State  Water  Project.)  The 
interaction  between  energy  and  water  problems  could  have  been  even  worse  if 
proposed  coal  slurry  pipelines  had  been  operating:  they  would  have  had  such  a 
low  water  priority  that  their  operation  would  probably  have  been  severely  cur¬ 
tailed,  contributing  to  a  kind  of  common-mode  failure  of  supposedly  redundant 
hydroelectric  and  coal-electric  systems. 

As  drought  persisted  in  the  Western  states,  the  Eastern  two-thirds  of  the 
country  simultaneously  suffered  record  cold.  This  ra i sed heat ing  costs  by  an 
estimated  $4-8  billion  and  increased  oil  imports  by  approximately  a  further  150 
million  barrels — a  total  increase  of  200  million  barrels  worth  $6  billion,  not 
an  insignificant  contributor  to  a  weak  dollar  and  a  tight  world  oil  market. 

The  unprepared  natural-gas  industry  burned  12%  of  its  stored  inventory  in 
November  (compared  to  zero  the  previous  winter).  Some  systems  were  withdrawing 
gas  when  they  normally  injected  it.  One  major  pipeline  company  sold  its 
reserves  prematurely;  some  gas  storage  areas  were  so  cold  that  pumping  capacity 
was  insufficient  to  retrieve  stored  gas  (id.:94],  Gas  supplies  ran  short, 
putting  over  a  million  people  out  of  work  in  twenty  states  and  costing  up  to 
$100  million  in  unemployment  benefits.  Over  45%  of  the  gas  shortfall  was  in 
Ohio,  already  hard  hit  by  disrupted  coal  and  fuel-oil  deliveries. 

Perhaps  the  most  disturbing  feature  of  this  disruptive  weather  pattern  is 
that  the  same  one  that  causes  Western  drought  and  Eastern  cold  also  typically 
causes  simultaneous  cold  weather  in  Europe  and  Japan  [JjK  97].  It  thus  offers  a 
potential  for  severe  pressure  on  world  oil  markets  if  it  happens  to  coincide 
with  a  supply  shortfall.  Recent  shortfalls  have  been  only  by  a  few  percent;  a 
simultaneous  north-temperate-zone  cold  spell  could  roughly  double  this  magni¬ 
tude.  The  possibility  of  bad  weather  not  only  heightens  vulnerability  to 
routine  shortages  or  deliberate  disruptions  of  energy  supply;  the  disruption 
can  be  deliberately  timed  to  coincide  with  bad  weather.  Thus  in  Britain,  the 
onset  of  winter  is  commonly  associated  with  militancy  among  fuel  and  power 
workers  in  recollection  of  the  effectiveness  of  the  miners'  strike  in  toppling 
the  Heath  Government  in  1974.  Sabotage  of  electric  grids  could  likewise  be 
timed  to  coincide  with  peak  loads  or  major  plant  outages  or  both.  Whether  in 
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one  country  or  globally,  improved  energy  efficiency  (Chapter  6)  would  offer  an 
effective  hedge  against  these  eventualities  by  greatly  reducing  both  the  amount 
of  energy  needed  and  the  sensitivity  of  that  amount  to  weather. 

2.1.5.  Limited  substitutability. 

The  infrastructure  for  using  fuels,  whether  directly  or  via  electricity, 
has  been  built  on  the  assumption  that  several  competing  fuels  will  always  be 
readily  available  in  essentially  unlimited  quantities.  Each  fuel-using  device, 
on  the  other  hand,  is  usually  built  to  take  a  particular  fuel  assumed  to  be 
cheaper  than  its  competitors.  The  lifetime  of  these  devices  typically  ranges 
from  one  to  several  decades.  Until  such  recent  developments  as  the  commercial¬ 
ization  of  fluidized-bed  boilers  [Patterson  &  Griffin  1978],  it  was  costly  and 
uncommon  for  boilers  to  be  designed  to  burn  more  than  one  or  at  most  two  kinds 
of  fuel — especially  to  handle  both  solid  and  liquid  fuels,  because  they  require 
different  kinds  of  equipment  to  store  and  feed  them,  and  the  duplication  of 
investment  would  normally  be  unattractive.  Accordingly,  a  complex  pattern  of 
past  investments  locks  each  region  and  each  industry  into  a  relatively  inflexi¬ 
ble  pattern  of  fuel  and  power  use,  limiting  its  adaptability  to  interruptions. 

This  problem  is  perhaps  most  familiar  to  electric  utilities,  whose  plants 
represent  the  largest  fixed  industrial  asset  in  the  whole  economy.  Past  fuel 
interruptions  (the  1973-74  oil  embargo,  the  1978  coal  strike,  the  1975-77 
Western  drought,  occasional  natural  gas  curtailments,  generic  nuclear  shut¬ 
downs)  have  highlighted  regional  concentrat ions  on  one  or  another  fuel.  Utility 
plans  for  1989  [Department  of  Energy  1981:1:4-12]  reflect  continuing  fuel 
special izat ion  of  different  kinds  in  virtually  every  region:  over  75%  coal 
dependence  in  the  East  Central  states;  over  50%  oil  in  the  Florida  and  Southern 
California/Nevada  regions;  over  25%  oil  in  the  New  York,  New  England,  Northern 
Cali  form' a/Nevada,  and  Arizona/New  Mexico  pools;  over  50%  gas  in  South  Central; 
25-50%  nuclear  in  New  England,  Pennsylvania/New  Jersey/Maryland,  Chicago  area, 
and  several  others;  and  over  60%  hydro  in  the  Pacific  Northwest.  This  might  at 
first  sight  look  like  healthy  diversity;  but  it  also  guarantees  that  a  major 
interruption  in  the  supply  of  any  of  these  sources  will  put  at  risk  the 
electrical  supplies  of  at  least  one  substantial  region. 

Substitutability  is  limited  not  only  between  fuels  but  between  different 
types  of  the  same  fuel.  There  are  different  kinds  of  coal  whose  c<  ,tent  of 
ash,  sulfur,  and  heat  vary  respectively  by  one  or  two  orders  of  magnitude,  at 
least  one  order  of  magnitude,  and  a  factor  of  at  least  two.  Conventional  fur¬ 


naces  can  burn  coal  only  within  a  specified,  often  rather  narrow,  range  of 
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chemical  and  physical  properties.  On  a  home  scale,  most  stoves  perform  effi¬ 
ciently,  cleanly,  and  safely  with  either  hardwood  or  softwood  but  (in  the 
absence  of  special  design  features)  not  both.  Leaving  aside  the  immense  vari¬ 
ety  of  refined  products  (many  of  which  are  not  interchangeable  in  end-uses)  and 
considering  only  crude  oil,  there  are  many  different  kinds  differing  in  speci¬ 
fic  gravity  (heaviness),  chemical  composition,  and  trace  impurities  such  as 
sulfur  and  heavy  metals.  Refineries  normally  need  to  blend  crude  oils  of  dif¬ 
ferent  composition — a  logistical  problem  of  considerable  complexity  at  the  best 
of  times,  but  one  of  critical  importance.  "In  some  areas  of  the  country  large 
refinery  complexes  depend  on  a  specific  crude  oil  supply  [whose] ...  interruption 
...could  shut  down  [ the]  .. .plant .  If  this  refinery  were  the  sole  supplier  of 
particular  feedstock  to  a  petrochemical  plant  which  was  one  of  a  very  few  mak¬ 
ing  specific  products,  such  as  toluene,  tetraethyl  lead,  butadiene,  specific 
solvents,  or  other  chemicals,  the  loss  could  be... of  strategic  importance." 
[Stephens  1973:14]  Refineries  designed  for  low-specific-gravity  crudes  cannot 
suddenly  switch  to  high-gravity  crudes  without  developing  "bottlenecks"  which 
limit  their  capacity.  Refineries  meant  for  sweet  (low-sulfur)  crudes  are  not 
built  of  the  special  alloys  required  to  withstand  the  severely  corrosive  sour 
(high-sulfur)  crudes.  There  are  similar  restrictions  on  the  purity  and  heat 
content  of  natural  gas  suitable  for  various  kinds  of  processing,  transmission, 
and  use.  Even  in  storage  of  liquid  fuels,  "clean"  tanks,  barges,  tankers,  etc. 
are  not  interchangeable  with  "dirty"  ones  contaminated  by  crude  oil  or  heavy 
fuel  oils;  cleaning  vessels  is  costly  and  time-consuming.  In  many  complex 
ways,  therefore,  prolonged  disruption  of  normal  fuel  supplies  can  severely  con¬ 
strain  the  ability  of  the  fuel-processing  and  -using  industries  to  improvise. 

In  many  cases  the  modifications  needed  for  (say)  oil  refineries  to  switch  to  a 
different  kind  of  crude  take  many  months  and  cost  many  millions  of  dollars;  it 
is  not  just  a  matter  of  turning  valves  [Deese  &  Nye  1981:40]. 

2.1.6.  Unique  properties  of  grid  electricity. 

Fossil  fuels  are  in  general  straightforward  and  relatively  cheap  to  store 
in  bulk.  With  reasonable  care  to  protect  e.g.  piles  of  coal  from  spontaneous 
combustion  and  tanks  of  crude  oil  from  gaining  moisture,  stocks  are  fairly  dur¬ 
able.  Nuclear  fuels  (leaving  aside  possible  safeguards  problems)  are  still 
cheaper  and  more  durable  to  store:  for  a  ten-year  supply  of  low-enriched 
uranium  fuel,  warehousing  charges  are  infinitesimal  and  carrying  charges  add 
less  than  1%  to  the  delivered  price  of  electricity.  Electricity  itself,  how¬ 
ever,  is  uniquely  awkward  and  expensive  to  store  in  bulk.  This  means  that  the 
central  supply  of  electricity  requires  a  continuous,  direct  connection  from 


source  to  user.  This  is  not  required  by  any  other  energy  system — not  even 
natural  gas,  which  interposes  substantial  storage  between  processing  plants  and 
users.  It  means  that  interruptions  of  central-electric  supply,  having  no  buf¬ 
fer  storage,  are  instantaneously  disruptive.  The  electrical  link  is  especially 
fragile  because  it  must  not  only  carry  electrons,  but  carry  them  in  a  particu¬ 
lar,  precisely  defined  time  pattern  of  variation  exactly  synchronous  with  that 
of  the  grid.  The  serious  problems  of  grid  stability  which  this  raises  are 
discussed  near  the  end  of  section  2.2.1. 

2.1.7.  Inflexibilities  of  energy  delivery  systems. 

A  monumental  study  of  the  U.S.  energy  transportat i on  system  [Congressional 
Research  Service  1977:1:84-89]  identifies  six  aspects  of  system  flexibility: 
adaptability  to  changes  in  throughput,  fuel  used  to  operate,  weather,  and 
routing;  ability  to  build  facilities  quickly;  speed;  and  ability  to  handle 
joint  shipments  of  different  fuels.  Several  of  these,  plus  ability  to  reverse 
direction,  require  brief  amplification: 

-  Volume .  Normal  fluctuations  in  demand,  let  alone  the  abnormal  require¬ 
ments  of  substitution  for  other  interrupted  supplies,  make  it  desirable  to  be 
able  to  change  the  amount  of  energy  transmitted,  quickly  and  within  wide  »_ 
limits.  All  present  means  of  coal  transportation  have  this  property  insofar  as 
they  need  no  fixed  or  minimum  throughput.  Railroad  and  barge  traffic  cannot 
greatly  expand  without  overloading  key  track  sectors,  locks,  etc.,  but  at  least 
within  those  limits  the  volume  is  free  to  fluctuate.  For  oil,  pipeline  routes 
and  capacities  are  fixed;  trucks  are  highly  flexible;  and  railways  and  water¬ 
ways  are  intermediate  in  flexibility,  having  fixed  trunk  routes  but  ability  to 
move  equipment  along  them  to  where  it  is  most  needed  (and,  in  the  case  of  rail¬ 
ways,  to  add  spur  lines).  This  ability  paid  off  in  1940-42,  when  the  Atlantic 
Seaboard  was  95%  dependent  (and  oil  shipments  to  England  were  wholly  dependent) 
on  coastal  shipping  vulnerable  to  German  submarines.  Twenty  thousand  idle 
railway  tank  cars  were  reconditioned  and  put  into  oil-hauling  service  "almost 
overnight"  [j_d_. :  1 71- 1 72}  .  Synthetic  rubber  tanks  and  barrel-loaded  boxcars 
were  also  pressed  into  service.  The  oil  unit  trains  "were  highballed  from  one 
railroad  to  another"  on  "fifty  railroads  and  fifty-six  routes,"  achieving  a 
peak  shipment  rate  of  0.93  million  barrels  per  day.  Commandeered  barges  also 
moved  an  average  1.3  Kb/d  on  the  Mississippi.  Surprisingly,  the  same  need 
might  arise  even  today,  since  there  is  still  no  crude-oil  pipeline  serving  the 
East  Coast  refineries  (New  Jersey,  Pennsylvania,  Delaware),  and  an  interruption 
of  Atlantic  or  Gulf  tanker  traffic  would  shut  them  down.  Only  the  Colonial 
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Pipeline  System,  with  a  capacity  of  approximately  2.1  million  barrels  per  dav. 
provides  substantial  capacity  for  importing  refined  products  to  the  Eas: 

Coast.  Should  that  pipeline  not  operate,  replacing  its  product  flow  (to  say 
nothing  of  bringing  crude  to  the  East  Coast  refineries)  would  require  the  equi¬ 
valent  of  more  than  200  World  War  II  T-2  tankers  (16,000  dwt)  on  a  continuous 
13-day-round-trip  shuttle  between  Galveston  and  New  York — approximately  the 
whole  U.S.  coastal  tanker  capacity,  and  enough  to  cause  a  monumental  traffic 
jam  in  the  ports  [Stephens  1973:114]. 

-  Facilities  construction.  Road  shipment,  though  usually  the  most  costly 
and  energy-intensive,  also  generally  offers  the  shortest  construction  times  and 
the  greatest  topographic  freedom  of  choice.  Its  infrastructure  is  also  multi¬ 
purpose,  not  specialized  to  fuel  supply  like  gas  and  power  lines.  Railway  and 
waterway  facilities  are  usually  too  costly  for  any  but  large  users  to  buy  them. 

-  Speed  and  joint  shipment.  In  coat  shipment,  the  cheapest  method  (barge) 
is  also  the  slowest,  least  flexible,  and  most  weather-vulnerable;  the  most 
flexible  in  routing  (truck)  is  also  the  costliest;  railways  offer  various 
compromises  between  flexibility  and  economy.  All  can  keep  different  kinds  of 
loads  separated.  So,  surprisingly,  can  pipelines*,  which  can  move  their 
contents  thousands  of  miles  in  a  few  days..  Electricity  moves  instantaneously. 

-  Reversibility.  Oil  and  gas  transmission  pipelines  now  in  operation  are 
generally  unidirectional  [Congressional  Research  Service  1977:1:14],  They  can 
be  reversed,  and  have  been  [ id . : 1 78 , 181 ]  ,  by  modifying  valves  and  compressors. 


*For  example  [Congressional  Research  Service  1977:1:198-200],  the  Colonial 
Pipeline  System,  the  largest  and  probably  the  most  complex  in  the  world,  has 
three  adjacent  pipes,  the  largest  having  a  diameter  of  36"  (91  cm),  fed  from 
ten  source  points  and  distributing  to  281  marketing  terminals.  Thirty-one 
shippers  dispatch  120  varieties  of  products  to  56  receiving  companies.  In 
1973,  after  an  investment  of  over  $527  million  since  1962,  nearly  2000  miles  of 
main  pipe  and  over  1500  miles  of  lateral  lines  containing  over  1  million  tons 
of  steel  were  being  operated  by  fewer  than  600  total  employees;  it  took  a 
product  batch  12  days  to  move  from  Houston  to  Linden  NJ ,  powered  by  84  pumping 
stations  (totalling  826,075  horsepower  or  over  600  MW)  using  over  2  GWe-h  per 
year — enough  to  run  for  a  month  in  1973  all  the  houses  in  Louisiana,  Georgia, 
Mississippi,  and  South  Carolina.  It  took  ten  companies  just  to  supply  the 
valves  for  this  extraordinari ly  complex  engineering  project  [Stephens  1973: 
115].  The  Colonial  system  accepts  minimum  batches  of  75,000  barrels,  occupying 
a  12-mile  (19-km)  length  of  pipe  (an  amount  which  takes  an  hour  and  a  half  to 
pass  a  fixed  point),  and  separates  them  from  adjacent  batches  of  different  com¬ 
position  by  inflating  between  them  a  water-filled  rubber  "batching  sphere"  that 
fits  the  inside  pipe  diameter.  Constant  monitoring  of  the  specific  gravity  of 
transmitted  product  enables  operators  to  divert  the  "interface" — the  small  mix¬ 
ing  zone  formed  by  leakage  around  the  batching  sphere — into  holding  vessels  for 
reseparation  or  blending  into  products  of  saleable  purity.  The  order  of  batch¬ 
ing  is  carefully  defined  to  minimize  contact  between  incompatible  products,  a 
full  product  sequence  requiring  ten  days.  For  products  more  viscous  than  the 
higher-distillate  heating  oils,  pipeline  shipment  is  impractical. 
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Oil  unit  tank  trains  [_id_.  : 255 J  are  even  more  easily  reversible,  requiring  only 
appropriate  loading/unloading  equipment.  Electrical  grids  are  usually  reversi¬ 
ble  without  modification,  subject  to  requirements  of  safety,  metering,  and 
stability  (discussed  below).  In  contrast,  in  the  1977  coal  strike,  Federal 
authority,  though  extensive  (protecting  coal  distribution,  requiring  emergency 
electric  interties,  mandating  allocations  and  sales  of  coal,  etc.),  did  not 
extend  to  physically  moving  coal  [Subcommittee  on  Energy  &  Power  1978:18],  but 
most  of  the  coal  was  not  available  to  be  moved  anyhow  because  most  power-plant 
coal  depots  had  equipment  only  for  unloading  coal  onto  piles,  not  for  reloading 
it  for  shipment  to  someplace  else  [  id .  :9]  . 

2.1.8.  Interactions  between  energy  systems. 

An  energy  system  can  fail  because  it  does  not  receive  external,  auxiliary 
energy  it  needs  in  order  to  run.  Gasoline  pumps,  for  example,  generally  run  on 
grid  electricity.  On  the  day  an  Amoco®  gas  station  powered  by  an  array  of 
solar  cells  was  being  dedicated  in  1980  in  West  Chicago,  a  violent  thunderstorm 
cut  off  all  power  in  the  area,  and  the  solar-powered  station  was  the  only  one 
in  operation  [Energy  Insider  1980:4].  (The  American  Petroleum  Institute  has 
published  [Federal  Emergency  Management  Agency  1979:22-23]  an  excellent  guide 
to  nine  emergency  methods  of  dispensing  gasoline  in  a  power  failure,  using 
motor  vehicles,  lawnmowers,  bicycles,  portable  engines,  or  human  muscles  for 
motive  power.)  Electric  power  failures  have  often  shut  down  sewage-treatment 
plants  that  were  not  powered  by  their  own  methane  byproduct.  Most  municipal 
water  plants  require  grid  electricity  to  operate  [Nevin  1969;  Pickering  1969]; 
so,  currently,  do  most  oil  refineries  [Stephens  1970],  About  half  of  U.S. 
domestic  oil  extraction  depends  on  electrical  suppies  [Stephens  1973].  Except 
for  the  small  fraction  of  U.S.  coal  carried  in  slurry  pipelines,  virtually  all 
coal  transportation  depends  on  diesel  fuel  [Energy  6  Defense  Project  1980:77], 
so  a  cutoff  of  imported  oil  "may  threaten  our  supply  lines  for  coal  as  well" 
[Congressional  Research  Service  1977:1:75].  Failure  of  power  for  dewatering 
pumps  can  flood  coal  mines  so  badly  as  to  force  their  abandonment.  All  heavy 
machinery  depends  on  a  continuous  supply  of  lubricants  from  the  oil  industry. 
Refineries  need  electrically  pumped  cooling  water.  Many  power  stations  depend 
on  diesel  generators  for  safe  shutdown  and  to  run  critical  control  and  protec¬ 
tive  circuits  if  the  stations  and  their  grid  supplies  fail.  Some  fuels,  too, 
are  coproducts  of  others  (natural  gas  liquids  from  natural  gas  processing,  for 
example),  and  still  others,  like  heating  oil  or  propane,  can  become  scarce  if  a 

shortage  of,  say,  natural  gas  forces  buyers  to  substitute  [Federal  Emergency 
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Management  Agency  1979:1].  Interactions  between  different  forms  of  energy 
supplies  can  leave  even  the  homeowner  stranded:  most  oil-  or  gas-fired 
furnaces  need  electricity  to  run  their  pumps  and  igniters.  In  short,  any 
disturbance  in  the  intricately  interlinked  web  of  fuel  and  power  supplies  can 
spread  out  in  complex  ripple  effects  at  all  levels,  from  primary  supply  to 
end-use,  complicating  substitutions  and  exacerbating  the  initial  shortage. 

Another  worrisome  interdependence  of  supposedly  independent  energy  systems 
can  arise  from  their  colocation.  Broken  water  mains  can  short  out  electric 
cables.  A  1  iquef ied-gas  tanker  accident  could  destroy  a  power  station  or 
refinery.  Fire  and  explosion  can  propagate  between  nearby  pipelines  or  through 
a  tank  farm.  Exploding  gas  mains  can  simultaneously  disable  electric  and 
telephone  cables  located  in  the  same  tunnels  under  city  streets.  Early  on  13 
February  1981,  an  hour  before  rush-hour  traffic,  some  3  to  12  miles  of  Louis¬ 
ville's  streets  were  instantly  torn  up  by  exploding  sewers,  apparently  filled 
with  hexane  leaking  from  a  factory  a  mile  from  the  point  of  ignition  [Marshall 
1981].  Such  an  accident  could  easily  knock  out  all  under-street  utilities  at 
the  same  time.  During  the  British  conversion  to  North  Sea  gas,  some  public 
telephone  booths  started  exploding:  the  higher  gas  pressure  was  too  much  for 
old  joints,  and  the  leaking  gas  entered  adjacent  telephone  cable  conduits  and 
seeped  up  into  the  booths,  ready  for  someone  to  walk  in  with  a  lit  cigarette. 

2.1.9.  High  capital  intensity. 

Capital  intensity  reflects  resource  intensity  and  thus  indirectly  measures 
the  difficulty  of  building  a  system  with  limited  resources.  High  capital 
intensity  also  has  important  operational,  financial,  and  social  consequences. 
Most  modern  energy  supply  systems  are  extremely  capital  intensive.  Some,  such 
as  electric  utility  plant,  are  the  most  capital-intensive  in  the  whole  economy, 
with  a  capital/output  ratio  several  times  that  of  manufacturing  industry.  In 
general,  synthetic-fuel  and  frontier  (Arctic  and  offshore)  oil  and  gas  systems 
require  about  ten  times  as  much  capital  per  unit  of  capacity  for  delivering 
additional  energy  to  final  users  as  did  the  traditional  direct-fuel  systems 
(such  as  Appalachian  coal,  Texas  oil,  and  Louisiana  gas)  on  which  the  American 
economy  was  built.  Central-electric  systems,  in  turn,  are  about  ten  times  more 
capital-intensive  still  [Lovins  1977b, 1978].  The  resulting  capital  charges 
generally  exceed  the  operating  costs  and  profits  that  are  the  remaining  compo¬ 
nents  of  energy  price.  Carrying  charges  for  a  plant  costing,  say,  $2  billion 
(such  as  a  nominal  50,000  bbl/d  synfuel  plant)  can  easily  exceed  half  a  million 
dollars  per  day  ($6  per  second),  payable  whether  the  plant  runs  or  not. 
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This  has  several  important  consequences.  First,  the  designers  will  be  un¬ 
able  to  afford  much  redundancy — major  backup  features  that  cost  a  lot  but  are 
seldom  used.  Second,  there  will  be  a  strong  temptation  to  skimp  on  downtime 
for  routine  maintenance — a  temptation  commonly  indulged  in  reactor  operations. 
A  similar  reluctance  to  shut  down  oil  refineries  for  maintenance  if  they  can  be 
kept  running  without  it  means  that  minor  leaks  which  in  prior  years  would  have 
been  quickly  fixed  are  now  often  allowed  to  continue  for  a  year  or  more. 

The  prevalence  of  known  but  unfixed  leaks  and  other  faults  greatly  increases 
both  the  likelihood  of  fire  and  the  workers'  exposure  to  toxins  and  suspected 
carcinogens.  These  economically  motivated  risks  are  a  chief  cause  of  refinery 
strikes  by  the  Oil,  Chemical  and  Atomic  Workers'  Union. 

Another  result  of  high  capital  intensity  is  limited  ability  to  adapt  to 
fluctuating  demands.  Quirk  and  Moriarty  [1980:93]  point  out  that  the  Natural 
Gas  Policy  Act  of  1978,  passed  in  the  wake  of  the  1976-77  winter  gas  shortages 
and  giving  absolute  priority  to  residential  and  small  commercial  users,  may 
have  a  perverse  effect.  These  users,  who  may  not  be  interrupted,  have  the  most 
temperature-sensitive  demand,  whereas  industrial  customers,  who  must  be  inter¬ 
rupted  first,  have  the  least.  In  a  cold-weather  gas  shortage,  a  utility  with 
many  uninterruptible  customers  might  reap  windfall  profits  from  unexpected 
extra  sales,  while  a  utility  selling  mainly  to  interruptible  industrial  custo¬ 
mers  might  go  into  the  red  by  losing  sales  needed  to  support  unaltered  capital 
charges.  Profit-maximizing  utilities  may  therefore  seek  to  raise  their  propor¬ 
tion  of  uninterruptible,  temperature-sensitive  customers,  thus  increasing  total 
national  vulnerability  to  a  cold-weather  gas  shortage. 

The  economic  need  for  capital-intensive  plants  to  run  nearly  continuously 
places  a  high  premium  on  the  correctness  of  engineering  expectations  that  they 
will  prove  reliable.  Technical  mistakes,  bad  weather,  external  interference, 
etc.  can  produce  massive  economic  penalties  as  well  as  disrupting  energy  sup¬ 
plies.  For  example,  the  financial  fallout  from  the  Three  Mile  Island  accident 
—  in  terms  of  reduced  bond  ratings,  higher  cost  of  money,  and  the  like — is 
proving  more  crippling  to  General  Public  Utilities  than  the  direct  costs  of  the 
cleanup  or  of  buying  replacement  power.  High  capital  intensity  also  commonly 
reflects  a  degree  of  complexity  that  hampers  diagnoses  and  repair  of  faults  and 
limits  available  stocks  of  costly  spare  parts  (section  2.3).  The  corresponding 
managerial  complexity  places  additional  stress  on  another  scarce  resource, 
especially  scarce  in  emergencies — the  attention  of  gifted  managers. 


2.1.10.  Long  lead  times. 
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The  time  it  takes  to  build  a  major  energy  facility — of  the  order  of  a 
decade,  or  irreducibly  perhaps  half  that — contributes  to  its  capital  cost  and 
investment  risk.  It  requires  foreknowledge  of  demand,  technological  and 
political  conditions,  and  costs  further  into  the  future,  when  forecasts  are 
bound  to  be  more  uncertain.  This  uncertainty  imposes  a  severe  financial 
penalty  on  bad  guesses,  especially  overconst ruct i on — a  diseconomy  of  scale 
considered  further  in  Chapter  5.  Frequently,  long  lead  times  require  major 
facilities  to  be  built,  or  at  least  their  designs  frozen,  before  significant 
operating  experience  is  gained  with  their  evolutionary  predecessors.  This 
tendency  to  run  ahead  of  sound  engineering  experience  tends  to  encourage  costly 
mistakes  which  may  seriously  affect  long-term  energy  supplies. 

Long  lead  times  also  create  risk  even  if  forecasting  is  perfect.  This  is 
because  people  considering  in  1981  a  bi l l ion-dol lar  commitment  to  a  plant  that 
cannot  be  finished  until  1991  and  must  then  operate  into,  say,  the  2020s  want 
to  know  with  confidence  the  conditions  of  finance,  regulation,  and  demand 
throughout  this  period.  But  they  want  this  certainty  in  a  society  whose  values 
and  institutions  are  in  rapid  flux — a  society  that  changes  its  politicians 
every  few  years.  If  democracies  are  to  retain  their  flexibility  and  adaptive¬ 
ness,  they  must  remain  free  to  change  their  minds.  This  is  not  a  problem  of 
accurate  forecasting  but  of  maintaining  political  degrees  of  freedom  essential 
to  our  concept  of  governance.  It  means  that  the  certainty  desired  by  the  pro¬ 
moters  simply  cannot  be  given.  This  tension— perhaps  a  fundamental  incompati¬ 
bility  between  the  characteri st i cs  of  many  modern  industrial  investments  and 
those  of  a  pluralistic  political  system  in  a  changing  world — is  bound  to 
express  itself  somehow,  and  is  an  inherent  source  of  vulnerability  in  these 
facilities  or  in  the  adaptability  of  our  institutions  or  both. 

2.1.11.  Specialized  labor  and  control  requirements. 

Modern  society  is  becoming  disturbingly  dependent  on  skills  possessed  by 
small  numbers  of  highly  organized  people.  Air  traffic  controllers,  for 
example,  are  virtually  i rreplaceable ,  at  least  on  short  notice.  A  24-hour 
strike  by  1500  controllers  and  allied  staff  (presumably  500  per  shift)  recently 
did  what  Hitler  was  unable  to  do — close  British  airspace  [Los  Angeles  Times 
1981b] .  Likewise,  modern  systems  for  the  continuous  bulk  delivery  of  energy 
are  exceedingly  complex  and  require  meticulous  automatic  and  manual  control 
which  is  understood  and  can  be  run  and  maintained  by  only  a  few  highly  trained 
specialists.  Railway  loading  operations  are  almost  unique  in  having  so  far 
largely  resisted  automation,  retaining  human  judgment  instead  of  computeriza¬ 
tion  [Congressional  Research  Service  1977:1:267];  gas  and  oil  pipelines  and 
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electric  grids  are  already  almost  completely  computerized.  This  is  indeed 
essential  because  of  their  complexity. 

An  oil  pipeline,  for  example,  needs  several  dispatchers,  but  they  could 
not  unaided  keep  track  of  the  status  of  pumps,  valves,  flow  rates,  batch  loca¬ 
tions,  schedules,  metering,  costs,  etc.  (Just  a  3°F  change,  for  example,  in 
the  temperature  of  the  entire  36"  Colonial  pipeline,  or  a  130  lb/in^  pres¬ 
sure  change,  would  change  its  volume  by  some  10,000  barrels  worth  several 
hundred  thousand  dollars  [ J_d .  :200-20 1 ]  . )  Stephens  [  1973:34]  remarks  that  in 
one  major  pipeline  system,  "One  small  room,  in  a  large  southern  city,  houses 
the  complete. . .control  system  [ for] ...  several  states ...  .Forced  entry  to  the 
computerized  ce.iter  [and  low-technology  sabotage] .. .could  suddenly  put  the 
entire  system  back  on  hand  operation.  Each  control  valve,  of  many  hundreds, 
would  have  to  be  visited,  but  now  only  a  few  men  are  available  to  run  the 
system.  There  are  no  repair  crews  except  contract  crews  in  most  cases."  The 
Plantation  and  Colonial  pipelines,  supplying  most  of  the  Eastern  Seaboard's 
refined  products,  not  only  parallel  each  other  and  interconnect  at  many  vulner¬ 
able  points;  the  control  systems  for  both  are  in  the  same  building.  "A  repeat 
of  the  University  of  Wisconsin  action  by  saboteurs  could  do  serious  damage  to 
these  operations"  [ id . : 1 14]  .  (Colonial  has  installed  a  backup  control  center.) 

Perhaps  most  dependent  on  control  automation  are  electric  grids,  where 
transient  events  such  as  lightning  bolts  or  routine  circuit  interruptions  often 
require  actions  within  hundredths  of  a  second  to  prevent  damage.  Giving  effect 
to  control  decisions  throughout  the  far-flung  grids  of  wires  and  pipelines 
requires  complete  dependence,  therefore,  on  computer  decisions  not  first 
checked  by  human  judgment,  and  on  electronic  telecommunications  links — a 
dependence  whose  disturbing  consequences  are  explored  in  later  sections. 

The  specialized  nature  of  the  control  systems,  and  of  maintenance  opera¬ 
tions  needed  to  maintain  both  them  and  the  devices  they  control,  concentrates 
immense  power  in  few  hands.  The  economic  and  social  cost  of  energy  disruption, 
let  alone  the  direct  financial  damage  incurred  by  carrying  charges  on  idle 
equipment,  place  "power  to  the  people"  in  the  hands  of  very  small  numbers  of 
people  well  aware  of  that  power.  As  an  official  of  the  British  power  workers' 
union  remarked  shortly  after  a  coal  strike  had  brought  down  the  Heath  Govern¬ 
ment  in  1974,  "The  miners  brought  the  country  to  its  knees  in  eight  weeks;  we 
could  do  it  in  eight  minutes."  His  colleagues  have  since  repeatedly  threatened 
national  blackouts  as  a  prelude  to  negotiations  for  various  desired  conces¬ 
sions,  including  (in  one  recent  instance)  basic  wages  of  up  to  $50,000  per  year 
[Daily  Mail  1979]^  Ironically,  the  Conservative  Government's  well-known  desire 

to  reduce  vulnerability  to  future  coal-miners'  strikes  by  substituting  nuclear 

power  would  increase  vulnerability  to  disruption  by  even  more  specialized  and 
♦Israeli  power  workers,  as  we  write  this,  are  gradually  blacking  out  the 
country  [Los  Angeles  Times  1981n] . 


nearly  as  militant  workers  in  power  plants  and  power  dispatching  centers. 
Electrical  supplies  have  also  become  a  bargaining  chip  in  Australia  [Straits 
T imes  1980]  and  elsewhere,  as  have  water  supplies,  sewage  treatment,  and  other 
utilities  essential  to  public  health  and  safety.  However  responsibly  a  union 
or  management  able  to  control  such  key  utilities  may  behave,  the  very  possibil¬ 
ity  of  disruption  tends  to  foster  suspicion  and  intolerance  if  not  worse,  fur¬ 
ther  increasing  the  social  tensions  which  themselves  contribute  to  the  risk. 

2.1.12.  Adaptability  of  fuel  distribution  systems  to  other  materials. 

Virtually  all  analyses  have  considered  the  vulnerability  of  energy  systems 
only  to  interrupt  ions  of  supply.  Many  systems  can,  however,  be  interfered  with 
in  other  ways  at  least  as  damaging — large-scale  versions  of  putting  sugar  in  a 
gasoline  tank.  A  few  examples  make  the  point: 

-  It  would  probably  not  be  difficult  to  introduce  a  foreign  substance  into 
crude  oil  being  stored  or  pipelined  to  many  refineries.  Such  substances  might 
include  radiotoxins  which  will  neither  affect  nor  be  affected  by  processing  but 
would  be  widely  dispersed  by  subequent  burning  of  the  refined  products.  Like  a 
suspicion  of  botulism  in  canned  foods,  they  could  make  substantial  amounts  of 
petroleum  products  unfit  for  use  (or,  for  that  matter,  for  destruction  by  con¬ 
ventional  means),  and  could  be  an  effective  means  of  extortion.  Alternatively, 
certain  substances  could  be  introduced  which  are  potent  poisons  of  refinery 
cracking  catalysts.  Since  most  cracking  catalysts  are  in  fluidized  rather  than 
fixed  beds,  with  a  residence  time  of  order  seconds,  poisoning  them  has  mainly  a 
nuisance  value,  requiring  more  catalyst  to  be  replaced.  Before  crudes  ire 
hydrocracked ,  they  also  go  through  a  demetallizing  stage  to  remove  most  of  the 
nitrogen,  sulfur,  nickel,  and  vanadium,  and  this  stage  uses  relatively  poison- 
resistant  catalysts.  Poisoning  the  very  large  volumes  of  oil  in  pipelines  or 
storage  to  a  level  sufficient  to  interfere  seriously  with  refining  would  in  any 
event  require  large  amounts  of  contaminant,  as  the  catalysts  are  not  as  sensi¬ 
tive  to  heavy-  or  alkali-metal  poisons  as  (say)  photographic  emulsions  are  to 
mercury.  Nonetheless,  there  are  some  special  circumstances  in  which  this  type 
of  potential  interference  is  worth  considering. 

-  The  national  grid  of  natural-gas  pipelines — over  a  million  miles  for 
transmission  and  distribution — offers  an  inviting  route  for  dispersing  unpleas¬ 
ant  materials.  In  early  1981,  the  Envi ronmental  Protection  Agency  found  that 
natural  gas  systems  in  Southern  California,  Chicago,  and  Long  Island  had  become 
accidentally  contaminated  with  liquid  PCBs  (polychlorinated  biphenyls),  an 
extremely  persistent  and  toxic  liquid  whose  manufacture  was  banned  in  the  U.S. 
in  1976  but  which  is  still  widely  used  in  transformers,  capacitors,  etc. 
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:  ri  i  1  1  iter  1*8) ] .  Not  only  retail  distribution  systems  but  also  some  segment - 
ot  interstate  pipelines  and  their  gate  stations  were  cont ami na t ed .  EPA  thinks 
the  PCBs  may  have  entered  the  gas  lines  as  a  pump  or  compressor  lubricant  tnan\ 
years  ago,  perhaps  via  leaky  seals.  The  PCBs  detected  in  retail  customers' 
meters  are  not  so  far  believed  to  mean  that  burning  the  gas  had  actually  re¬ 
leased  significant  amounts  o|  PCBs  indoors.  Nonetheless,  there  are  cheap,  very 
* 

disagreeable  substances  whicl}  could  be  deliberately  introduced  in  bulk  into  the 
national  gas  grid  from  any  of  thousands  of  loosely  supervised  access  points. 

Such  substances  could  be  widely  distributed  and  released  before  likely  detec¬ 
tion.  Some  could  contaminate  the  inside  of  the  pipel ines--the  third  largest 
fixed  asset  in  all  American  industry — so  as  to  make  them  very  difficult  to 
clean  up.  Whether  a  major  public  hazard  could  be  caused  in  this  way  would 
require  further  analysis  at  an  indiscreet  level  of  specificity;  but  it  appears 
there  is,  at  a  minimum,  a  potential  for  causing  public  anxiety  and  disruption. 

-  Another  category  of  potential  threats  might  involve  the  fuel  distribu¬ 
tion  system  or  local  storage  tanks.  Apparently  some  organisms  promote  the  gel¬ 
ling  of  liquid  oil;  others  have  been  developed  to  eat  oil  slicks  at  sea.  It 
may  become  possible  for  self-reproducing  organisms  of  either  kind  to  become  a 
threat,  accidents’ ly  or  deliberately,  to  oil  storage  and  processing  systems*. 

It  is  hard  to  say  whether  this  would  be  easy  or  difficult,  and  it  may  seem  far¬ 
fetched;  but  strikingly  effective  instances  of  biological  sabotage  are  already 
known,  ranging  from  releasing  moths  in  a  cinema  to  sowing  spores  of  certain 
mushrooms  which,  on  sprouting,  hydraulically  fracture  any  concrete  that  has 
meanwhile  been  poured  over  them.  The  adaptability  of  organisms  and  the  ingenu¬ 
ity  of  some  amateur  biologists  suggest  that  biological  threats  cannot  be  dis¬ 
counted.  Already,  such  accidental  infestations  as  Mediterranean  fruitfly, 

Corb icul a  in  power  plants  (Ch.  1.2.1),  kudzu  on  much  Southern  land,  and  water 
hyacinths  on  waterways  suggest  a  considerable  potential  for  mischief. 

-  Finally,  an  analogous  problem  may  exist  with  electricity,  because  as 
much  harm  can  be  caused  by  increasing  as  by  interrupting  its  supply.  Some 
manipulations  of  electrical  control  systems  may  be  able  to  increase  grid  vol¬ 
tages  to  levels  which  damage  not  only  generating  and  transmission  equipment  but 
also  widely  dispersed  distribution  and  end-use  equipment.  This  has  already 
happened  by  accident,  as  in  restoration  after  the  July  1977  New  York  blackout 
described  in  the  following  section.  Alternatively,  persistent  low  voltage  or 
operation  of  only  one  of  several  phases  on  nultiphase  lines  can  cause  epidemics 
of  burned-out  motors  and  other  equipment  over  a  wide  area:  Stephens  [1970:149] 
notes  an  oilfield  operation  that  lost  153  motors  in  one  evening  in  this  way. 
Repairing  such  widespread  damage  to  end-use  devices  can  be  extremely  slow  and 


*Oil  stored  in  South  African  gold  mines  was  reportedly  gelled  by  fungi  and 
bacteria,  making  it  very  hard  to  ex-extract  [GRAB  1980:65).  Some  refined  pro¬ 
ducts  can  be  stored  for  only  a  few  months  to  years  unless  stabilized  by  spec¬ 
ial  additives  [Davis  1981];  presumably  destabilizing  additives  also  exist. 
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costly.  As  noted  below  (Chapters  2.2.3  and  3.2.3),  analogous  interference  with 
gas  distribution  pressures  can  endanger  large  numbers  of  end-users  simultane¬ 
ously,  even  on  the  scale  of  an  entire  city. 

2.2.  Graceful  Versus  Catastrophic  Failure  in  Energy  Systems 

The  previous  section  has  identified  some  elements  of  modern  energy  systems 
that  make  them  vulnerable  to  the  threats  noted  in  Chapter  1.  But  such  a  cata¬ 
logue  cannot  capture  the  interactive  vulnerability  of  a  whole  energy  system. 
This  section  therefore  examines  several  case-studies  of  ungainly  failure,  and 
some  of  energy  systems  that  failed  with  grace. 

2.2.1.  The  13-14  July  1977  New  York  City  blackout. 

The  failure  of  the  60-Hz  electric  power  grid  in  New  York  in  July  1977  was 
not  the  first  or  the  largest  to  occur  there.  In  1965,  a  cascading  power  fail¬ 
ure  originating  in  a  malfunctioning  relay  in  Canada  interrupted  the  electrical 
supply  of  most  of  the  Northeastern  United  States.  Some  thirty  million  people 
were  blacked  out  for  anywhere  from  one  to  13-1/2  hours.  A  load  totalling  43.6 
GWe — 23%  of  1965  U.S.  peak  demand  or  18%  of  1965  installed  generating  capacity 
— was  lost  [Federal  Power  Commission  1977:26).  On  13  July  1977,  three  days 
after  the  Chairman  of  Consolidated  Edison  Co.  of  New  York  had  said  he  could 
"guarantee"  that  a  recurrence  was  remote  [Congressional  Research  Service  1979: 
142],  nearly  nine  million  people  were  blacked  out  for  5-25  hours  through  "a 
combination  of  natural  events  (lightning],  equipment  malfunctions,  questionable 
system  design  features,  and  operating  errors"  coupled  with  serious  lack  of 
preparation  to  use  available  facilities  to  prevent  complete  failure  [Federal 
Energy  Regulatory  Commission  1978:1]. 

Geography  and  operational  circumstances  contributed  to  the  1977  blackout. 
The  New  York  City  grid  relies  heavily  on  imports  of  bulk  power  in  a  narrow  cor¬ 
ridor  from  the  north,  where  power  is  available  at  relatively  low  cost  and  can 
be  delivered  overland  without  requiring  expensive  underwater  cables.  This 
clustering  of  lines  increases  vulnerability  to  storms  and  sabotage.  There  are 
some  interconnections  in  other  directions,  but  in  July  1977,  one  key  link  was 
inoperable  because  a  phase-regulating  transformer,  after  causing  several  earli¬ 
er  local  power  failures,  had  failed  beyond  repair  ten  months  earlier  (it  even¬ 
tually  took  over  a  year  to  replace  [Subcommittee  on  Energy  &  Power  1977:34,149- 
154; 1978a:44,95] ) .  Three  generating  plants  on  the  Con  Ed  system  were  also  down 
for  repair:  the  Indian  Point  2  nuclear  plant  (873  MWe) ,  with  a  failed  pump 


42 


seal;  Bowline  Point  #2  (601  MWe )  ,  with  a  boiler  problem;  ami  Astoria  f:l  (775 
MWe) ,  wi  th  a  turbine  failure.  Within  the  Con  Ed  area,  there!.. re,  onlv  3.6  GWe 
was  being  generated  to  serve  a  load  of  6.1  GWe,  and  the  rest  was  being  imported 
through  six  interties.  It  is  the  successive  failure  of  these  transmission 
systems,  and  their  interaction  with  local  generators,  that  led  to  the  system 
failure.  There  was  plenty  of  generating  capacity  available  in  the  "pool"  of 
adjacent  utilities  with  which  Con  Ed  was  interconnected,  but  by  the  late 
evening  of  13  July  1977,  there  was  no  way  to  deliver  that  power  to  the  city. 

Perhaps  the  best  description  of  the  failure  sequence  is  by  Boffey  [1978]: 

The  trouble  began... when  lightning  struck  a[n  imperfectly  grounded 
transmission-line]  tower  in  northern  Westchester  County  and  short-circuit¬ 
ed  two  345-kilovolt  lines. ... [Pjrotect ive  re  lays . . . tr iggered  circuit 
breakers  to  open  at  both  ends  of  the  affected  lines,  thus  isolating  the 
problem  from  the  rest  of  the  system.  This  is  exactly  what  the  circuit 
breakers  are  supposed  to  do.  However,  they  are  also  supposed  to  reclose 
automatically  once  the  fault  dissipates,  and  this  they  failed  to  do.  One 
transmission  line  failed  because  of  a  loose  locking  nut  [which  released 
air  pressure  from  a  circuit  breaker:  Clapp  1978:10]...;  the  other  because 
a  reclosing  circuit  had  been  disconnected  and  not  yet  replaced.... 

Two  other  facilities  also  tripped  out  of  service.... A  nuclear  reactor 
[Indian  Point  3]  shut  down  automatically  when  the  circuit  breaker  that 
opened  to  contain  the  lightning  fault  also  [by  a  design  fault]  deprived 
the  reactor  of  any  outlet  for  its  power . . . . [ A] nother  345-kilovolt  line — a 
major  tie  across  the  Hudson — tripped  out  because  a  protective  timing  de¬ 
vice  was  designed  improperly ... .Thus,  in  one  stroke  of  misfortune.  Con  Ed 
lost  three  major  transmission  lines  and  its  most  heavily  loaded  generator. 

Even  so.  Con  Ed  regained  its  equilibrium  by  importing  more  power  on  the 
remaining  tie  lines  and  by  increasing  its  own  generation  somewhat  [but  did 
not  restore  a  safety  margin]  ... .Then  lightning  struck  again... and  short- 
circuited  two  more  345-kilovolt  lines.  Again  there  was  a  malfunction.  One 
line  reclosed  automatically  [but]... the  other  remained  open  because  a  re¬ 
lay  had  been  set  primarily  to  protect  a  nuclear  reactor  (which,  ironical¬ 
ly,  was  out  of  service)  rather  than  to  facilitate  reclosing  of  the  line 
....The  loss  of  the  1  ine ..  .caused  a  temporary  power  surge  that  tripped 
out  another  345-kilovolt  line.  This  should  not  have  happened  but  did, 
because  of  a  bent  contact  on  a  relay. 

Con  Ed's  control  room  succumbed  to  confusion  and  pan i c . . . . ( The ]  system 
operator  [ assumed] ..  .a  particular  transmission  line  was  still  in  service 
[ and] . .  .  fai led  to  read  a  teletype  [saying  it  was  down ]... .Moreover , 
because  of  Con  Ed's  antiquated  control  room  layout,  he  was  unable  to  see 
a  more  dramatic  indicator  in  another  room--a  flashing  screen  with  a  high- 
pitched  alarm.  The  personnel  there  knew  the  line  was  out  but  failed  to 
tell  him....[H]e  ignored  [ seven] .. .suggest  ions  from  the  power  pool  that  he 
shed  load.  Then,  as  the  situation  deteriorated,  he. ..dumped  his. . .respon¬ 
sibility  on  his  boss,  the  chief  system  operator,  who  sat  at  home  in  the 
dark  reading  diagrams  by  a  kerosene  lantern  and  issuing  orders  over  the 
phone.. ..The  chief  ordered  voltage  reductions — but  these  were  too  little 
and  too  late.  Eventually  he  also  ordered  that  a  block  of  customers  be 
disconnected.  Whereupon  the  confused  operator  [rendered  the  load-shedding 
control  panel  inoperable  by  apparently  turning]... a  master  switch  the 
wrong  way. 

The  performance  of  Con  Ed's  generators  was  equally  erratic.  Con  Ed's 
system  operator  delayed  8  minutes. . .before  requesting  a  fast  load  pickup 
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from  generators  that  were  supposedly  able  to  re«pond  in  10  minutes.  He 
[then]  got  only  half  the  power  he  expected — and  only  302  of  what  Con  Ed 
had  incorrectly  told  the  power  pool  it  could  provide.  Some  equipment 
malfunctioned;  other  units  were  undergoing  routine  inspection  but  had  not 
been  removed  from  the  fast-start  capability  list;  some  were  not  even 
manned.  [All  the  night-shift  operators  had  been  sent  home,  and  the 
remote-start  capability  had  been  removed  some  years  earlier:  Subcommitee 
on  Energy  4  Power  1977:32,100-101.  At  most  55%  of  Con  Ed's  total  in-city 
generating  capacity  was  actually  operable:  j_d.  1978:53.]  Similarly,  when 
Con  Ed  sounded  the  maximum  generation  alarm  some  10  minutes  after  the 
second  lightning  strike,  it  again  failed  to  get  the  anticipated  response 
from  its  30-minute  reserve  generators. 

As  the  system  cascaded  toward  collapse,  heavy  overloads  caused  the 
failure  or  deliberate  disconnection  of  all  remaining  ties  to  neighboring 
utilities.  Con  Ed [ ' s] . . .  last  hope  was  an  automatic  load  shedding  system 
that  had  been  installed  after  the  1965  blackout.  [it]  worked  beautifully 
to  disconnect  customers ... .But  it  also  unexpectedly  caused  a  rapid  rise  in 
system  voltage  that  caused  a  major  generator  to  shut  down.... The  remaining 
generators  could  not  restore  equilibrium.  Eventually,  protective  relays 
shut  them  down  to  prevent  damage ...[ and]  the  city  was  blacked  out. 

Nearly  twelve  weeks  later,  on  26  September  1977,  another  thunderstorm 
tripped  four  transmission  lines  with  six  lightning  bolts.  Automatic  reclosing 
equipment  again  failed  to  perform,  shutting  down  40%  of  Con  Ed's  generation. 
Only  a  more  alert  operator  response  in  shedding  Westchester  loads  prevented  a 
second,  more  serious  blackout  from  spreading  again  across  the  city.  On  that 
occasion,  the  equipment  failures  included  an  out-of-service  instrumentation 
channel  at  Indian  Point  3  [Clapp  1978:22],  a  wiring  error  in  a  relay  [  :C3]  , 
deactivation  of  a  reclosing  circuit  by  the  unexplained  placing  of  a  switch  in 
the  wrong  position  [ : 2 3] ,  and  a  defective  relay  [  : 25 ]  .  Like  earlier  equipment 
faults,  these  resulted  from  "serious  failures  in  inspection  and  testing"  1:39} . 
Though  local  trip  systems  prevented  in  1977  most  of  the  serious  damage  that  the 
1965  blackout  had  caused  to  1.5  GWe  of  generating  equipment  [Joint  Committee  on 
Defense  Production  1977a:23],  many  of  the  underfrequency  relays  meant  to  shed 
load  automatically  in  1977  did  not  initially  operate. 

Serious,  multiple  operator  errors,  reminiscent  of  those  identified  in  the 
Three  Mile  Island  accident  by  the  Kemeny  and  Rogovin  reports,  also  dominated 
the  July  1977  blackout.  Many  of  the  training  and  procedural  problems  had 
already  been  identified  in  the  1965  blackout  [Subcommittee  on  Energy  &  Power 
1977:53-65]  but  not  fixed.  Lack  of  unambiguous  linguistic  conventions  like 
those  used  in  air  traffic  control  contributed  to  the  confusion  [Federal  Energy 
Regulatory  Commission  1978:139]:  different  operators  concealed  their  meaning 
from  each  other  and,  on  occasion,  from  themselves.  The  system  operator  was 
apparently  hard  of  hearing  anyway  [Subcommittee  on  Energy  &  Power  1977:46], 
perhaps  contributing  to  his  poor  performance  in  communicating  over  the  tele¬ 
phone  from  a  noisy  and  doubtless  chaotic  control  room. 
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Three  technical  features  of  the  1977  blackout  deserve  special  attention. 
First,  it  was  of  a  character  unforeseen  in  any  official  design  criteria.  The 
State's  investigator  concluded:  "The  inability  to  achieve  stable  isolated 
operation  [i.e.  without  interties  to  adjacent  areas]  steins  from  a  general 
failure  to  think  through  the  problems  that  transmission  losses  can  create.  For 
example,  virtually  no  planning  consideration  has  been  given  to  the  generation 
reserves  needed  in  the  event  of  transmission  losses.  Installed  generation 
reserve  capacity  is  determined  solely  with  reference  to  potential  generat ion 
shortages.  Similarly,  the  Pool's  minimum  operating  reserve  cri terion. . . is 
designed  to  meet  generation  shortages,  not  transmission  losses  [,  and...] 
assumes  sufficient  transmission  exists  to  deliver  the  members '... reserve  capa¬ 
city  to  the  system  suffering  the  shortage.  Where  disturbances  on  the  bulk 
transmission  system  severely  limit  the  ability  to  transfer  power,  the  Pool’s 
existing  reserve  requirements  are  inadequate."  [Clapp  1978:59-60]  This  had 
already  been  clearly  noted  in  the  1965  Federal  Power  Commission  report  to 
President  Johnson — "Cascading  power  failures  are  usually  the  result  of  insuf¬ 
ficient  capability  within. . .transmission  links" — but  neither  Con  Ed  nor  Pool 
criteria  followed  the  logic.  The  reason  Con  Ed  had  not  realized  that  load 
shedding  would  produce  overvoltage  and  trip  the  Big  Allis  generator  at  Ravens- 
wood  was  that  they  had  simply  never  analyzed  the  behavior  of  an  isolated  Con  Ed 
system  [Boffey  1978:995]*. 

Second,  the  July  1977  power  failure  produced  unexpected  secondary  conse¬ 
quences  that  seriously  hampered  recovery.  There  was  inadequate  light  and  power 
for  troubleshooting  or  manually  operating  major  substations  [Joint  Committee  on 
Defense  Production  1977a:5]  .  Auxiliary  equipment  at  power  stations — lubricat¬ 
ing  and  cooling  pumps,  boiler  feedwater  pumps,  etc. — failed  gradually  with 
declining  voltage,  compromising  and  in  some  cases  modestly  damaging  major 
equipment  [Federal  Energy  Regulatory  Cotnnission  1978:49].  Assessment  of  the 
status  of  equipment,  and  coordination  of  early  restoration  efforts,  was  also 
hampered  by  the  complete  failure  of  Con  Ed's  UHF  and  VHF  radio  networks.  The 
main  repeater  had  two  power  sources;  one  had  failed  before  the  blackout  and  the 
other  failed  to  start.  The  backup  power  supply  to  the  backup  repeater  station 
also  failed  to  operate.  This  triple  failure  also  exposed  shortcomings  in 
radiotelephones  and  direct  telephone  lines.  The  backup  radio  repeater  was  not 
repowered  until  another  emergency  power  source  could  be  hooked  up  two  and  a 
half  hours  later  [  id.  :45]  . 

Most  dismaying  was  the  unexpectedly  rapid  loss  of  pressure  in  oil  needed 
to  insulate  and  cool  the  main  high-voltage  underground  power  cables.  After  the 

1965  blackout,  standby  generators  had  been  provided  to  operate  generator  lubri- 

*The  isolation  of  St.  Louis  on  13  February  1978  was  also  a  surprise  [NERC  1979: 

13-14],  but  resulted  in  overfrequency  and  caused  no  loss  of  load. 
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eating  pumps  and  other  key  protective  equipment  in  power  stations.  The  Federal 
Power  Commission  had  then  recommended  installing  standby  power  for  pumping  oil 
to  the  underground  cables  too — as  Commonwealth  Edison  Co.  had  done,  for  less 
than  half  a  million  dollars,  in  the  underground  Chicago  cable  system.  Apparent¬ 
ly  Con  Ed  was  unaware  of  this  recommendation.  That  cost  them  at  least  five 
hours  in  recovery  time  in  1977  {Subcommittee  on  Energy  &  Power  1977:26-27). 

They  had  thought  the  cables  would  hold  oil  pressure  for  4-6  hours  [Subcommittee 
on  Energy  &  Power  1978a:139l,  but  pressure  actually  decayed  much  faster.  This 
caused  many  short-circui’ s  and  some  equipment  damage,  causing  further  delays 
which  lost  more  oil  pressure.  Finally  it  was  necessary  to  bring  in  portable 
generators  to  run  the  oil  pumps,  restore  all  oil  pressure  throughout  the  length 
of  the  cables,  and  monitor  pressure  at  all  terminations  and  connections  before 
the  cables  could  be  safely  re-energized  {Federal  Power  Commission  1977:20,46). 

Third,  the  July  1977  Con  Ed  blackout  illustrated  some  general  features  of 
large  (and  especially  of  urban)  electric  grids  that  make  their  operation  more 
difficult  to  sustain  in  emergencies.  These  can  be  better  understood  by  refer¬ 
ence  to  what  happens  when  power  flows  in  a  grid  are  interrupted. 

Sudden  trips  (disconnections)  of  elements  of  power  systems  occur  comnoniy 
in  the  midst  of  normal  operation.  If  lightning  short-circuits  a  transmission 
line,  for  example,  automatic  circuit  breakers  open,  then  attempt  to  reclose  in 
a  fraction  of  a  second  and  again  in  several  seconds  if  at  first  unsuccessful. 
Users  are  aware  only  of  a  brief  flickering  of  the  lights  if  all  goes  well.  If, 

however,  the  fault  has  not  cleared  (or  the  breaker  does  not  work  properly),  the 

breaker  will  remain  open.  If  an  alternative  transmission  path  is  available  (as 
it  normally  is),  the  electrical  flow  redistributes  itself  within  a  few  cycles. 
This  may  overload  other  lines.  They  can  tolerate  substantial  overloads  for 
short  periods  without  overheating,  and  can  even  be  run  for  up  to  four  hours  at 

their  "long-time  emergency  rating"  without  damage,  but  before  t ime-and-tempera- 

ture  limits  on  the  lines  are  reached,  operators  must  reroute  power  or  shed 
loads  to  bring  the  lines  within  safe  limits.  Similar  readjustments  may  also  be 
needed  after  the  initial  rapid  redistribution  of  power  flows  that  accompany  the 
sudden  trip  of  a  loaded  generator.  Further,  the  generator  itself  must  rapidly 
bypass  steam  from  its  turbine  in  order  to  avoid  serious  damage  from  spinning 
too  fast  without  load.  Thereafter  the  turbogenerator  cannot  be  rapidly  recon¬ 
nected  to  the  grid,  but  must  be  brought  up  gradually  from  almost  zero  load 
{Federal  Energy  Regulatory  Commission  1978:15-16). 

In  practice,  the  detailed  electrical  phenomena  occurring  when  normal  bulk 
power  flows  are  interrupted  are  very  complex  and  demand  elaborate  mathematical 
analysis.  One  kind  of  potentially  damaging  aberration  is  rapid  transients  of 
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voltage  or  current  [id.]:  "[A]  stiff  mechanical  structure  [which] .. .receives  a 

shock  at  one  point... may  be  damaged  by  [a  propagating  wave  of]  stress  appearing 
far  from  the  point  of  the  original  shock ...( depend ing]  on  the  form  of  the 
structure  and  the  relative  stiffness  and  strength  of  its  members."  Electrical 
networks  have  analogous  elements  and  properties.  Transient  surges  of  high 
voltage  can  break  down  insulation  in  a  cable  or  transformer,  thereby  causing  a 
secondary  fault.  A  current  surge  can  likewise  trip  a  protective  breaker  and 
needlessly  disconnect  a  circuit.  The  electrical  properties  of  long  transmission 
lines  a.id  (especially)  of  long  underground  cables  tend  to  enhance  transients. 

Alternating-current  power  grids  can  also  become  unstable  by  losing  their 
synchronization.  "In  normal  operation,  all  of  the  [generator]  rotors... are 
rotating  in  precise  synchronism.  Further,  the  power  output  and  other  electri¬ 
cal  quantities  associated  with  each  generator  are  absolutely  dependent  on  this 
synchronous  operation.  If  a  generator  is  subjected  to  a  sufficiently  large 
disturbance, .. .as. .. from  a  nearby  fault,  it  may...'pull  out1  of  synchronism, 
even  though  the  original  disturbance  is  momentary.  Once  synchronism  is  lost, 
the  power  output  of  the  unit  drops  rapidly"  [id. :  1 6— 17]  and  it  must  immediately 
be  taken  offline  until  ready  for  exact  resynchronization. 

If  a  power  grid  is  more  than  momentarily  subjected  to  a  load  larger  than 
it  can  sustainably  supply,  and  if  "spinnin~  reserve"  capacity  already  synchro¬ 
nized  with  the  grid  cannot  be  brought  into  full  production  to  make  good  the 
deficit,  the  operating  generators  will  slow  down  at  a  rate  that  depends  on 
their  "inertia  constant"  (ratio  of  stored  angular  momentum  to  output  rating) 
and  on  the  extent  to  which  the  change  in  line  frequency  changes  the  load  [ id . : 
37] .  The  frequency  of  the  whole  interconnected  system  is  thus  pulled  down  below 
the  normal  60  Hz.  This  can  cause  more  power  to  flow  toward  the  deficit  area, 
perhaps  further  overloading  transmission  lines  [ id.  :17]  and  probably  tripping 
protective  breakers.  If  protective  devices  do  not  work  properly,  different 
elements  of  a  grid  may  try  to  operate  at  significantly  different  frequencies, 
"bucking"  each  other.  This  causes  enormous  internal  stresses  and,  probably, 
serious  damage.  Some  modern  turbogenerators  of  very  large  capacity  (well  over 
1  GWe  in  a  single  unit)  work  so  close  to  the  yield  limits  of  their  materials 
that  they  have  little  safety  margin  for  the  stresses  generated  by  loss  of  syn¬ 
chronization:  some  will  reportedly  suffer  gross  mechanical  failure  (e.g.  by  the 
shaft's  flying  apart)  if  the  frequency  deviates  by  one  or  two  percent  while 
they  are  under  full  load. 

Transmission  lines,  because  of  their  electrical  properties,  are  subject  to 
two  kinds  of  limits  on  how  much  power  they  can  safely  handle:  thermal  limits, 

set  by  their  ability  to  dissipate  heat  to  their  surroundings  without  sagging, 
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and  system  stability  limits.  "Transfer  of  power  at  a  given  voltage  can  be 
increased  only  up  to  a  certain  level  beyond  which  it  becomes  impossible  to 
maintain  synchronous  operation  between  generators  at  the... ends  [of  the  line] 
....Following  a  disturbance,  it  is  possible  for  a  machine  to  operate  momentari¬ 
ly  past  the  stability  limit  and  then  to  regain  synchronism...,  but  this  ability 
is  limited  and  operating  conditions  are  established  to  maintain  operation  with¬ 
in  safe  limits  allowing  for  the  occurrence  of  some  disturbances."  [Econ.  Regul. 
Administr.  1981 : 1 : 2—5 ]  These  limits  become  more  stringent  at  higher  voltages 
and  with  longer  lines — both  characteristic  of  the  trend  towards  larger,  more 
remotely  sited  generating  plants. 

One  form  of  this  problem  was  illustrated  in  microcosm  in  the  New  York 
blackout.  Underground  cables,  used  throughout  Con  Ed's  area,  have  large  dis¬ 
tributed  capacitance  (ability  to  store  an  electric  charge  between  two  separated 
conductors).  This  capacitance  could  produce  large  voltage  transients  if  not 
compensated  by  series  inductances  (conductors  which  store  energy  in  their 
magnetic  field;  like  capacitors,  inductances  display  "reactance,"  or  ability  to 
resist  changes  in  the  direction  of  flow  of  an  alternating  electric  current). 

Con  Ed’s  "black-start"  procedures  (i.e.  for  restoring  the  grid  after  complete 
power  failure)  relied  on  the  windings  of  baseload  generators  for  about  two- 
thirds  of  the  needed  inductive  reactance,  but  none  of  it  was  initially  avail¬ 
able  for  compensation,  and  inductive  compensation  in  another  critical  circuit 
was  unusably  damaged  [Federal  Energy  Regulatory  Commission  1978:47-48],  Efforts 
to  restore  the  grid  rapidly  in  large  sections  apparently  led  to  series  reso¬ 
nance  effects  (electrical  oscillations)  between  the  unbalanced  inductive  and 
capacitive  elements,  causing  high-voltage  transients  that  damaged  cables, 
transformers,  and  switchgear  [id].  Indeed,  the  tripping  of  the  844-MWe 
Ravenswood  #3  generator  was  caused  by  cable  capacitance  too:  when  load-shedding 
removed  large  inductive  loads  (motors)  which  had  previously  compensated  for  the 
cable  capacitance,  the  capacitive  surge  raises  voltages  to  as  much  as  11.5? 
above  normal,  and  the  resulting  pathological  voltage-current  relationships 
confused  the  generator's  controls  so  much  that  it  shut  off  in  self-protection. 
This  sealed  the  fate  of  the  Con  Ed  grid  by  dropping  system  frequency  from  60  to 
57.8  Hz — a  level  low  enough  to  be  sustained  by  available  generating  capacity 
(automatic  load-shedding  already  having  occurred),  but  too  low  to  keep  power- 
plant  auxiliaries  (fuel  pumps,  draft  fans,  feedwater  pumps,  etc.)  running  fast 
enough  to  support  the  33  generators  still  operating.  The  resulting  vicious 
circle  of  plant  failures  and  further  declining  frequency  crashed  the  grid  in 
four  minutes  [Jd_. :  37-38 ,  Clapp  1978:17]. 

*The  isolated  Israeli  grid  could  have  tolerated  a  drop  of  at  least  5%,  equiv¬ 
alent  to  57.0  Hz:  it  uses  three  layers  of  under-  and  over-frequency  relays  to 
shed  and  restore  loads,  achieving  perhaps  the  world's  highest  load  factor.  The 
Eastern  European  grids  are  similarly  frequency-labile;  Western  European,  about 
five  times  less  so;  North  American,  about  five  times  less  so  again. 


These  stability  problems  are  not  unique  to  New  York's  cable  system;  in 
various  forms  they  are  emerging  nationally.  In  1976,  the  Assistant  Director 
for  Systems  Management  and  Structuring  in  the  U.S.  Energy  Research  and 
Development  Administration  [Fink  1976]  stated: 

If  is  becoming  apparent  that  the  increasing  complexities  of  the 
nation's  electric  energy  system  are  rapidly  outstripping  its  capabilities. 
Our  interconnected  electric  energy  systems  seem  to  be  evolving  into  a  new 
condition  wherein  "more"  is  turning  out  to  be  "different."  As  they  become 
more  tightly  interconnected  over  larger  regions,  systems  problems  are 
emerging  which  neither  are  presaged,  predicted,  or  addressed  by  classical 
electrical  engineering  and  which  are  no  longer  amenable  to  ad  hoc 
solut ion. 

Up  until  the  past  decade  the  ability  of  an  electrical  system  to  ride 
out  a  severe  electrical  disturbance  (i.e.  to  maintain  stability)  could  be 
evaluated  on  the  basis  of  its  ability  to  remain  stable  through  the  first 
rotor  angle  swing  (about  one  second)  following  the  disturbance.  It  is  now 
recognized,  however,  that  this  condition  is  no  longer  sufficient.  Instan¬ 
ces  have  occurred  wherein  systems  survived  for  several  swings  following  a 
disturbance  before  coming  unstable  due  to  a  lower  frequency  phenomenon. 

Accordingly,  the  industry  has  been  devoting  considerable  effort  to... 
studying  what  has  become  known  as  the  dynamic  stability  problem. ..[ and ]  it 
is  acknowledged  that  the  larger,  more  tightly  interconnected  system  is 
behaving  in  a  fashion  qualitatively  different  from  that  of  earlier  smaller 
systems . 

A  systems  problem  which  was  not  predicted ..  .but  which  has  rapidly 
become  the  focus  of  much. . .attention  is. . . subsynchronous  resonance.  [It 
was] ..  .standard  practice  [to  install]  series  capacitors  to  compensate  for 
the  inherent  inductance  of  very  long  lines  [i.e.  the  reverse  of  Con  Ed's 
requirements].  When  this  was  done  in  the  case  of  some  lines  out  west,  the 
resonant  frequency  of  the  series  capacitor-inductance  combination  was 
close  enough  to  the  natural  frequency  of  the  shafts  of  the  units  involved 
to  set  up  mechanical  vibrations  which  resulted  in  shaft  failure.  The 
phenomenon  is  amenable  to  analysis  by  available  theory,  but  the  necessary 
tools  were  not  readily  available  and  the  problems  were  not  anticipated. 

As  an  example  of  a  future,  potentially  important  problem  outside  the 
scope  of  classical  electrical  engineering,  we  point  to  the  fundamental 
problem  of  information  transfer  and  decision  making  in  the  case  of 
multiple  independent  control  centers,  whose  decisions  affect  primarily 
their  own  portions  of  a  common  interconnected  system.  In  actuality  the 
action  taken  by  any  one  such  center  affects  the  whole. ... [A]nalyzing. . . 
effective  control  st rategies . . . i s  in  its  infancy.*** 

Today's  electric  energy  system  in  the  United  States  is  one  of  the  most 
complex  technical  systems  in  existence.  Unlike  most  other  industries,  the 
individual  components  do  not  operate  independently  but  are  tied  together 
in  an  interacting  system  covering  most  of  the  continental  United  States, 
wherein  deliberate  or  inadvertent  control  actions  taken  at  one  location 
can  within  seconds  affect  the  operation  of  plants  and  users  hundreds  of 
miles  di stant . . . . [ T]he  introduction  of  complex  new  technologies  into  the 
existing,  already-complex  system  [and  the  need  to  consider  tighter  fiscal 
and  environmental  constraints  compound] .. .the  complexity  of  the  system. 

The  point  of  all  this  is  that  there  does  not  yet  exist  any  comprehen¬ 
sive  applicable  body  of  theory  which  can  provide  guidance  to  engineers 
responsible  for  the  design  of  systems  as  complex  as  those  which  will  be 
required  beyond  the  next  generat i on . . . . (T)here  will  be ...  problems  of  great 
importance  which  will  be  quite  different  from  today's  problems,  and  the 
conceptual  tools  and  underlying  theory  required  for  their  effective 
solution  have  not  yet  been  developed. 
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In  short,  there  is  a  good  deal  about  the  operation  of  modern  large-scale  power 
grids  that  able  engineers  are  hard  pressed  to  anticipate  even  in  normal  opera¬ 
tion.  In  abnormal  operation,  as  Con  Ed  found,  their  complexity  can  be  suffi¬ 
cient  to  defy  a  priori  analysis.  This  is  in  itself  a  source  of  vulnerability 
to  mistakes,  failures,  and  malice.  We  may  well  find,  as  power  systems  evolve 
in  the  present  direction,  that  they  have  passed  unexpectedly  far  beyond  our 
ability  to  foresee  and  forestall  their  failures. 

2.2.2.  Military  vulnerability. 

Even  when  energy  systems  were  considerably  simpler  than  modern  electrical 
grids,  they  proved  attractive  targets  in  wartime.  The  Energy  and  Defense  Pro¬ 
ject  [1980:19-29]  has  found  several  such  cases  instructive.  Hitler's  Germany 
used  electricity  for  three-fourths  of  industrial  motive  power,  as  well  as  for 
all  electrochemical  processes  (arc  furnaces,  electrolysis,  production  of  syn¬ 
thetic  nitrogen  and  oil  and  rubber).  Four-fifths  of  the  electricity  came  from 
central  thermal  plants.  These  wore  highly  concentrated:  in  1933,  1.4%  of  the 
thermal  plants  provided  over  half  the  total  output,  and  5%  provided  four-fifths 
of  the  output.  The  Allies,  however,  assumed  that  despite  this  inviting  concen¬ 
tration,  German  grid  interconnections  provided  enough  flexibility  of  routing 
that  power  stations  did  not  deserve  a  high  priority  as  bombing  targets,  and 
indeed  this  was  not  done  on  a  large  scale  until  the  vast  bombing  raids  of  1944. 
The  Nazis  were  delighted:  they  felt,  and  responsible  officials  including 
Goering  and  Speer  said  afterwards,  that  systematic  targeting  of  power  plants 
would  have  curtailed  the  war,  perhaps  by  two  years,  and  that  they  could  not 
understand  why  the  Allies  had  passed  up  such  an  efficacious  opportunity.  Seem¬ 
ingly  confirming  these  German  fears,  synthetic  oil  production,  which  by  early 
1944  accounted  for  over  half  the  German  oil  supply,  was  crippled  by  selective 
bombing  in  just  a  few  months,  bringing  much  of  the  Nazi  war  machine  to  a  halt. 

In  striking  contrast  to  this  centralized  vulnerability,  Japanese  electri¬ 
cal  production  in  World  War  II  [_id .  ]  was  relatively  decentralized:  78%  came 
from  small,  highly  dispersed  hydroelectric  plants  that  were  not  individually 
attractive  targets,  and  the  largest  single  dam  supplied  less  than  3%  of  nation¬ 
al  electricity.  The  more  centralized  thermal  plants,  though  they  provided  only 
22%  of  the  total  electricity,  were  so  comparatively  vulnerable  to  urban  bombing 
raids  that  they  sustained  99.7%  of  the  damage. 

This  lesson  was  not  lost  on  Allied  analysts:  the  centralized  hydroelectric 
dams  on  the  Yalu  River  became  a  key  target  in  the  Korean  War.  At  least  since 
then,  if  not  for  longer,  the  People's  Republic  of  China  has  reportedly  taken 
military  vulnerability  to  heart  in  dispersing  energy  facilities  (e.g.  most  of 
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rural  China's  electricity  comes  from  several  GWe  of  microhydro  sets,  often  of  a 
few  kWe  each  [Lovins  1978:495],  and  small  biogas  plants  provide  extensive  fuel 
for  cooking  and  lighting).  A  similar  philosophy  is  reportedly  applied,  so  far 
as  practicable,  in  Israel — especially  after  Israeli  jets  destroyed  virtually 
the  whole  of  Syria's  oil  installations  in  a  half-hour  early  in  the  Six  Days' 

War  because  they  were  all  in  one  place.  Rhodesia  made  the  same  mistake — cen¬ 
tralized  oil  depots — and  paid  for  it  (p.78)  when  black  nationalist  guerrillas 
blew  one  up  in  December  1978.  Likewise,  June  1980  opened  with  a  strong  attack 
on  the  SASOL  synthetic-fuel  plants  that  provide  much  of  South  Africa's  liquid 
fuel.  Similar  attacks  have  become  more  common  in  guerrilla  wars  since  Egyptian 
saboteurs  burned  British  oilfields  in  Libya  in  1956  [de  Leon  et  al .  1978:22]: 
at  this  writing,  guerrillas  are  said  to  be  closing  in  on  dams  and  power  plants 
in  such  countries  as  Chile  and  Angola.  On  14  June  1978,  Red  Brigades  terroi — 
ists  caused  $600,000  worth  of  damage  and  blacked  out  part  of  the  city  for  sev¬ 
eral  hours  with  a  series  of  bombs  in  a  power  station  [Tanner  1978].  Accident 
or  sabotage  in  a  San  Juan  power  plant  blacked  out  Puerto  Rico  on  10  April  1980, 
shortly  after  the  plant's  chief  engineer  was  kidnapped  [Anchorage  Times  1980; 
New  York  Times  1980d] .  San  Salvador  was  blacked  out  6  February  1981  by  a  power- 
plant  bombing — the  fourth  attack  on  power  installations  in  four  days  [Atlanta 
Journal  &  Constitution  1981];  by  20  March,  guerrillas  were  reportedly  surround¬ 
ing  a  dam  providing  half  El  Salvador's  electricity  [Los  Angeles  Times  1981m], 

The  French  military  establishment  is  reported  [Caputo  1980:42]  to  wish  to 
reduce  vulnerability  by  decentralizing  the  energy  system — a  desire  doubtless 
heightened  by  the  "impossible"  cascading  failure  of  virtually  the  the  entire 
French  electric  grid  on  19  December  1978,  with  lost  production  officially  esti¬ 
mated  at  nearly  $1  billion  [New  York  Times  1978,  1978a;  Le  Monde  1978,  1978a]. 
Even  in  the  Soviet  Union — where  central  electrification  has  been  a  sacred  tenet 
of  the  Communist  Party  since  Lenin  declared  Communism  to  consist  of 'fcol lect ives 
plus  electrification" — there  is  "reportedly  a  standing  argument  between  the  So¬ 
viet  military  and  the  Pol itburo. . . .The  military  argues  that  decentralized  ener¬ 
gy  systems  are  of  primary  importance  for  civil  defense  and  therefore  essential 
to  Soviet  national  security.  The  Politburo  insists  on  centralization  of  prima¬ 
ry  energy  systems  in  order  to  ensure  party  control,  and  is  apparently  prepared 
to  risk  a  significant  degree  of  national  security  to  do  so."  [Holmberg  1981] 

2.2.3.  Surviving  grid  failures. 

Centralized  supply  grids  cannot  discriminate  well  between  users.  Electri¬ 
city  for  a  water  heater,  which  may  be  unaffected  by  a  few  hours'  interruption, 
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must  bear  the  high  cost  of  the  extreme  reliability  required  for  subways  and 
hospital  operating  theaters.  A  degree  of  individual  matching  of  reliabiity 
between  source  and  need  can  save  a  lot  of  money,  as  noted  in  Chapter  7.  More¬ 
over,  the  grid  is  all-or-nothing:  it  must  be  so  reliable  because  its  failure  is 
so  catastrophic,  instantaneously  affecting  a  wide  area.  If  your  oil  furnace 
breaks  down,  you  can  put  on  a  sweater  or  go  next  door,  but  if  the  electric  grid 
fails,  t  >  is  no  next  door:  everyone  is  in  the  same  boat. 

Electrical  grids,  as  Con  Ed's  experience  testifies,  can  fail  catastrophi¬ 
cally.  So  can  pipeline  grids.  Both  expose  large  flows  of  energy  to  lasting 
and  instantaneous  disruption  by  single  acts,  with  only  limited  freedom  to  re¬ 
route.  But  while  electrical  grids  can  transmit  power  (provided  it  is  properly 
synchronized)  at  levels  varying  all  the  way  to  zero,  gas  pipelines  cannot:  the 
pumps  fail  if  gas  pressure  falls  below  a  certain  level.  In  practice,  this 
means  that  gas  grids  must  keep  input  in  step  with  output.  If  coal  barges  or 
oil  tankers  cannot  deliver  fast  enough  to  keep  up  with  demand,  there  is  simply 
a  shortage  at  the  delivery  end.  But  if  a  gas  grid  cannot  pump  fast  enough  to 
keep  up  with  demand,  it  can  cease  working  altogether.  In  January  1977,  calling 
on  stored  gas  and  adding  grid  interconnections  was  not  enough  to  keep  up  the 
grid  pressure,  so  major  industrial  customers  had  to  be  cut  off,  causing  severe 
dislocations  in  Ohio  and  New  York.  But  the  alternative  would  have  been  even 
worse,  because  pressure  collapse  could  not  have  been  confined  to  the  transmis¬ 
sion  pipelines.  Without  abundant  high-pressure  gas  being  supplied  continuous¬ 
ly,  the  gas  distribution  system  too  would  have  been  drained  below  its  own  crit¬ 
ical  pressure.  If  distribution  pressure  collapses,  pilot  lights  go  out  in 
innumerable  buildings  (including  those  not  currently  occupied),  requiring  a 
veritable  army  of  trained  people  to  go  immediately  into  each  one,  turn  off  the 
gas  to  prevent  explosions,  and  later  return  to  restore  service  and  relight  the 
pilots.  This  occasionally  happens  on  a  local  level,  but  has  hardly  ever 
happened  on  a  large  scale  (Paris  in  1944  might  be  an  instance).  It  is  such  a 
monumental  headache  that  gas  companies  strive  to  avoid  it  at  all  costs  [Kalisch 
1979];  indeed,  the  gas  industry  generally  considers  it  an  abstract  problem — 
much  as  the  electric  power  industry  considered  a  regional  blackout  until  1965. 
Yet,  ominously,  an  extortionist  threatened  a  few  years  ago  to  cause  a  brief 
interruption  in  Philadelphia's  gas  supply — long  enough  to  extinguish  the  pilot 
lights,  but  short  enough  to  cause  instant  and  widespread  "urban  revelopment" 
shortly  thereafter. 

Such  vulnerability  to  large-scale  system-wide  failure  with  catastrophic 
consequences  is  clearly  not  a  desirable  feature  for  any  energy  system.  But  it 
is  not  inevitable:  alternative  distribution  patterns  can  make  such  failures 
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impossible.  While  Ohio  and  New  York  factories  and  schools  were  shut  down  in 
the  gas  shortages  of  early  1977  to  prevent  a  wider  collapse  of  grid  pressures, 
gas  use  in  equally  chilly  rural  New  England,  in  striking  contrast,  was  virtual¬ 
ly  unaffected — especially  in  Vermont,  the  contiguous  state  least  served  by 
pipeline  gas.  The  difference  was  that  rural  New  Englanders  had  always  used 
bottled  gas.  System-wide  failures  with  loss  of  pumping  pressure  or  pilot 
lights  could  not  occur.  Not  everyone  ran  out  at  once,  so  neighbors  could  help 
each  other  through  spot  shortages. 

In  previous  gas  shortages,  too,  the  same  overstressed  supplies  of  natural 
gas  and  of  natural  gas  liquids  had  caused  disruptions  in  other  areas  but  not  in 
northern  New  England  with  its  decentralized,  unsynchronized  pattern  of  gas  de¬ 
livery  and  use.  It  is  true  that  bottled  gas  comes  from  remote  sources  and  that 
its  distribution  is  liable  to  disruption;  in  the  Ohio  River  Valley  in  early 
1977,  rural  deliveries  on  poorly  cleared  and  maintained  roads  could  not  always 
be  maintained  even  though  "extra  propane  trucks  were  sought  across  the  Nation" 
and  "Every  available  LPG  rail  car  was  purchased  or  leased"  [Congressional 
Research  Service  1977:111:190].  But  from  the  end-users'  point  of  view,  short¬ 
age  in  one  building,  and  at  a  fairly  predictable  time,  is  vastly  preferable  to 
simultaneous  area-wide  failures  without  warning.  This  capacity  is  also  con¬ 
sidered  an  important  preparedness  measure  by  some  Israeli  planners:  in  1975, 
although  there  was  no  gas  pipeline  service  in  Israel,  some  96%  of  homes  had  gas 
service — from  bottles — whose  independent,  highly  dispersed  storage  was 
virtually  undi sruptable. 

Another  incident  shows  the  value  of  independent  local  supplies  which,  like 
the  solar  cells  that  powered  the  Chicago  gas  station,  can  stand  alone  at  need, 
even  though  in  normal  operation  they  need  not  forego  the  advantages  of  grid 
interconnection.  In  Finland  several  years  ago,  a  general  strike  shut  down  much 
of  the  national  electrical  grid.  In  the  industrial  city  of  JyvSskylU,  how¬ 
ever,  the  local  combined-heat-and-power  station  (a  common  fixture  in  Scandina¬ 
via)  was  able  to  disconnect  from  the  grid  and  keep  the  city  powered  in  isolat¬ 
ion.  The  money  saved  by  not  having  to  shut  down  the  local  factories  for  the 
duration  of  the  strike  reportedly  paid  off  the  capital  cost  of  the  power  plant 
immediately,  greatly  impressing  city  officials  with  the  resilience  achieved  by 
such  simple  means.  This  feature  will  be  further  considered  in  Chapters  4  and  7. 

2.3.  Restoration  after  failure. 


Most  analyses  of  how  to  repair  damage  to  energy  systems  (and,  for  that 
matter,  of  how  to  prevent,  control,  and  contain  that  damage  in  the  first  place) 


have  an  academic  flavor  and  are  often  reminiscent  of  the  single-failure  criter¬ 
ion  occasionally  used  in  nuclear  engineering — the  assumption  that  only  one 
thing  will  go  wrong  at  a  time.  This  convenient  but  often  unrealistic  assump¬ 
tion  is  commonly  made  when  the  effects  of  multiple  failures  are  either  too 
disastrous  to  guard  against  (like  pressure-vessel  rupture)  or  too  complex  to 
analyze;  but  reactors  unfortunately  do  not  read  safety  reports.  The  history  of 
major  power-grid  failures,  like  the  Con  Ed  1977  blackout,  suggests  that,  as  in 
real  reactor  accidents,  a  complex  sequence  of  unforeseen  and  interactive  tech¬ 
nical  and  human  failures  is  not  only  possible  but  likely.  Recovery  measures 
designed  to  handle  simple,  singular  failures  will  not  work  when  many  things 
have  gone  wrong  and  more  dominoes  are  falling  every  minute.  Worse,  collapses 
that  were  caused  deliberately  can  be  expected  to  exploit,  rather  than  to  im¬ 
pinge  randomly  upon,  those  secondary  vulnerabilities  that  can  inhibit  response 
and  recovery.  Some  lessons  from  the  Con  Ed  blackout  point  up  the  kinds  of 
precautions  that  can  make  it  possible  first  to  survive,  and  then  to  recover 
from,  cascading  failures. 

Secondary  consequences  of  energy  supply  failures  car.  often  be  greatly 
mitigated  by  even  modest  advance  warning.  In  the  July  1977  New  York  blackout, 
for  example,  "Most  of  the  nearly  200  subway  trains  then  on  the  tracks  managed 
to  crawl  to  the  nearest  stations,  thanks  to  a  warning  from  a  quick-witted  dis¬ 
patcher;  still,  seven  trains  carrying  [fewer  than]  1,000  passengers  were  stuck 
between  stations  for  [several]  hours — and  the  entire  system  folded  thereafter 
for  the  duration."  [Newsweek  1977:20]  Deter i orat ion  of  power  supplies  and 
drivers'  reports  of  dark  or  flashing  signals  enabled  dispatchers  to  order 
trains  into  stations  via  a  two-way  radio  system  spanning  the  230  miles  of 
tunnels.  This  "decisive  action"  avoided  major  strandings;  all  passengers  were 
evacuated  within  3-1/2  hours  with  no  reported  injuries  [Federal  Energy  Regula¬ 
tory  Commission  1978:55],  In  contrast,  hundreds  of  rush-hour  commuters  were 
stuck  between  stations  without  warning  when  a  saboteur  switched  off  power  to 
the  central  Stockholm  subway  [Evening  Standard  1979]. 

An  intriguing  and  little-known  feature  of  the  New  York  blackout  is  that 
part  of  a  25-Hz  grid  (run  chiefly  for  railways)  and  most  of  a  direct-current 
grid,  both  within  the  city,  were  able  to  continue  normal  operation  while  the 
60-Hz  grid  crashed,  since  they  were  not  dependent  on  it  for  synchronization  and 
were  easily  isolated.  Unfortunately,  they  served  such  relatively  small  areas 
that  they  were  not  able  to  provide  a  bootstrap  for  60-Hz  recovery  operations. 
Local  60-Hz  standby  generators  generally  worked  well,  maintaining  operations  at 
bridges  and  tunnels  (mainly  supplied  from  New  Jersey  anyhow),  hospitals,  fire 
and  police  stations,  and  airports.  (Flights  were  suspended  overnight,  however, 
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and  32  a  ircraft  diverted,  because  obstruction  lights  on  New  York  skyscrapers 
were  out.)  Surface  transit  worked,  though  some  fuel  had  to  be  imported  from 
New  Jersey  for  buses.  Subway  officials  controlled  flooding  by  dispatching 
emergency  pumps  and  compressors  [Federal  Energy  Regulatory  Commission  1978:55]. 
Though  most  hospital  emergency  generators  worked,  four  hospitals  needed  police 
emergency  generators,  and  thirteen  other  establishments,  mainly  medical,  needed 
emergency  generators  repaired.  Con  Ed  dispatched  18  of  its  50  portable  genera¬ 
tors  throughout  the  city  to  run  lifesaving  equipment.  Had  the  hospitals  used 
their  own  generating  plants  routinely,  as  is  common  in  Europe,  rather  than  only 
in  emergencies,  they  would  have  achieved  higher  reliability  and  obtained  their 
heating  and  hot  water  as  a  virtually  free  byproduct  (Chapter  5). 

With  basic  emergency  services  (if  not  domestic  tranquility)  maintained, 
what  options  were  open  to  Con  Ed  officials  facing  a  darkened  city?  The  rerout¬ 
ing  capacity  of  electricity  and  gas  grids  is  substantial  (pp.87,92ff  ),  provid¬ 
ed  that  key  switching  points  are  operable.  Reestablishing  local  supplies,  how¬ 
ever,  may  presuppose  the  availability  of  scarce  resources,  both  physical  and 
human.  In  general,  utilities  have  much  experience  of  coping  with  localized 
failures,  but  little  if  any  of  improvising  in  the  face  of  large-scale  failures 
that  limit  help  from  adjacent  areas — the  position  Con  Ed  was  in  with  its  grid 
completely  isolated.  The  restoration  procedures  of  the  Northeast  Power  Coordi¬ 
nating  Council  at  the  time  of  the  1977  New  York  blackout  read  simply:  "1.  Re¬ 
store  frequency  to  60  hertz.  2.  Establish  communication  with  system  operators 
of  adjacent  systems.  3.  Synchronize  with  adjacent  systems.  4.  Coordinate  re¬ 
storation  of  any  load  previously  shed."  [Joint  Committee  on  Defense  Production 
1977a:105]  It  is  hard  to  escape  the  impression  that  if  adjacent  areas  are  also 
down,  or  if  damage  to  equipment  has  been  widespread,  most  utilities'  ability  to 
cope  would  be  quickly  overwhelmed.  Con  Ed's  were  certainly  stretched  to  the 
limit.  To  appreciate  why,  it  is  worth  reviewing  how  grid  restoration  works. 

The  Federal  Energy  Regulatory  Commission  [1978:21]  describes  electric  grid 
restoration  as  "a  complicated,  demanding  process.  Even  if  all  system  elements 
are  ready  for  service,  there  are  three  basic  problems  to  be  solved:  First,  the 
system. . .must  be  synchronized  with  neighboring  systems  through  interconnec¬ 
tions;  second,  substantial  time  must  be  allowed  for  the  large  steam-turbine 
generators  to  be  brought  up  to  full  output;  and  third,  as  generator  output 
becomes  available,  it  must  be  matched  by  gradually  increasing  the  connected 
customer  load  [which  is  often  beyond  the  utility's  direct  control  save  by 
switching  large  areas],  so  that  an  approximate  balance  of  generation  and  load 
is  maintained.  Solution  of  these  problems  usually  involves  "sect ional i z ing" 

the  system  [which  may  complicate  reactive  balancing  and  voltage-control  prob¬ 
lems,  as  in  the  Con  Ed  case]." 
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To  make  matters  worse,  "there  are  urgent  time  constraints  due  not  only  to 
the  need  for  restoring  service  to  critical  loads  but  also  due  to  the  fact  that 
the  condition  of  some  unenergized  system  components  will  degrade  with  time, 
making  restoration  even  more  difficult.  For  instance,  pressurized  circuit 
breakers  with  electric  heaters  may  fail  due  to  gas  liquefaction  or  loss  of  air 
pressure;  this  will  occur  more  rapidly  in  cold  weather,  and  they  may  not  become 
operable  again  until  hours  after  the  restoration  of  auxiliary  service.  Also, 
the  capacity  of  stand-by  batteries  for  operation  of  critical  facilities  will  be 
limited.  Another  time  const ra i nt ... i s  the  time  required  to  carry  out  the  many 
hundreds  of  switching  operations  necessary  to  excise  failed  equipment  and  lost 
loads  and  to  secure  whatever  portions  of  the  system. . .remain  operable."  [Econ. 
Regulatory  Adminis. 1981 : 6-9 fj  Picking  up  lost  loads  in  the  wrong  order,  or  in 
excessively  large  blocks,  may  further  damage  equipment.  Worst  of  all,  some 
power  stations  have  no  "black-start"  capability — they  cannot  restart  in  isola¬ 
tion,  but  only  if  supplied  with  outside  power  for  auxiliaries  or  synchroniza¬ 
tion  or  both.  Some  stations  which  are  supposed  to  have  this  capability  occa¬ 
sionally  turn  out  not  to.  Clearly,  the  improvisations  that  restoration  of  a 
crashed  grid  may  require  are  of  such  complexity  that  only  people  of  exceptional 
ability  can  be  expected  to  do  them  smoothly  without  considerable  practice;  yet 
opportuni r ies  for  that  practice  are  almost  nil,  and  simulation  exercises  for 
more  than  routine  local  outages  are  very  rare.  Utilities  are  also  reluctant  to 
join  neighboring  utilities  in  preparedness  drills  (or  in  installation  of  costly 
reliability  interties)  because  they  would  have  to  pay  the  cost  of  a  benefit 
shared  by  others. 

Recovery  is  often  limited  by  the  availability  of  spare  parts.  The  severe 
fiscal  constraints  on  most  electric  utilities  limit  their  stocks  to  routine 
essentials;  only  after  the  1977  blackout,  for  example,  did  Con  Ed  decide  to 
procure  a  spare  for  a  phase-regulating  transformer  whose  unavailability  had 
contributed  greatly  to  the  blackout,  which  had  previously  caused  four  lesser 
outages,  and  which  had  over  a  year's  manufacturing  lead  time  (supra) .  It  used 
to  be  customary  for  utilities  to  keep  spare  sets  of  large  generator  coils, 
large  bearings,  etc.,  but  with  higher  unit  costs  (owing  to  larger  unit  sizes) 
and  greater  manufacturing  specialization,  and  with  the  added  burden  of  ad 
valorem  inventory  taxes,  spares  have  greatly  dwindled  [Defense  Electric  Power 
Administration  1962:28].  Only  the  smaller,  cheaper,  more  frequently  needed 
items  are  now  commonly  stocked  [Joint  Committee  on  Defense  Production  1977a: 
108],  Spares  may  also  be  lost  in  a  major  accident  through  storage  in  vulner¬ 
able  locations  (_id_.  ]*•  For  example,  when  Typhoon  Karen  struck  Guam  in  November 
1962  with  sustained  winds  of  170  mph  and  gusts  up  to  207  mph  (equivalent  to 

*Spare  pumps  for  the  Trans-Alaska  Pipeline  (p.77)  are  proposed  to  be  stored  at 
the  pumping  stations  themselves — conveniently  for  operators  and  saboteurs. 
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about  5  psi  peak  overpressure),  and  electrical  distribution  systems  were  badly 
disrupted,  repair  was  "mater i al ly  lengthened"  by  the  total  loss  of  vital  spare 
parts  stored  in  light  sheet-metal  buildings  [Chenoweth  et  a  1 .  1963:8].  Similar¬ 
ly,  Stephens  [1973:16]  notes  that  a  five-mile  stretch  in  the  Harvey  Canal  near 
New  Orleans  contains  an  astonishing  concentrat ion  of  oil-well  service  companies 
whose  services,  vital  to  an  entire  industry,  could  become  unavailable  if  bot¬ 
tled  up  by  a  simple  lock  or  drawbridge  failure. 

Few  companies  have  retained  the  on-site  manufacturing  capabilities  they 
had  when  they  did  much  of  their  own  machine-shop  work.  Though  many  companies 
do  have  portable  substations  of  modest  size,  and  some  have  spare-part  sharing 
arrangements  with  adjacent  utilities,  most  major  items  still  have  to  be  import¬ 
ed  from  relatively  remote  manufacturers,  who  may  have  shortages  or  production 
problems  of  their  own.  The  complexity  of  modern  energy  equipment  is  tending  to 
increase  resupply  problems  and  lead  times.  Stephens  [1970:49,53],  for  example, 
sampled  in  1969  the  availability  from  stock  of  3-phase  explosion-proof  electric 
motors,  and  found  the  total  stock  of  four  main  U.S.  manufacturers  to  be  only  22 
motors  of  150  hp  and  up,  with  smaller  sizes  faring  little  better.  Most  larger 
sizes  required  special  ordering  with  delivery  dates  of  months.  Just  replacing 
the  explosion-proof  motors  required  for  a  single  small  crude-oil  distillation 
plant  "could  use  up  the  nation's  entire  supply  ->r  [such]  motors" — and  some  key 
components,  such  as  transformers,  seem  "even  scarcer."  Such  mundane  items  as 
the  hoses  and  couplings  needed  to  unload  oil  tankers  are  often  special-order 
[Stephens  1973:58].  Even  with  foresight,  there  are  limits  to  the  insurance 
that  spare-parts  inventories  can  buy:  "One  pipeline  company  keeps  two  of  each 
important  piece... of  critical  equipment  on  hand,  but  if  three  items  of  the  same 
[type]  were  damaged,  as  much  as  19  months  delay  could  be  created...."  [  id :  142] . 

In  the  best  of  circumstances,  and  based  on  data  from  1967  when  many  com¬ 
ponents  were  smaller  and  simpler  than  today's,  estimated  repair  times  for 
seriously  damaged  major  components  of  power  systems  [Lambert  1976:56-60] — and 
similarly  for  other  major  energy  faci l i t ies — are  daunting.  Typically  hundreds, 
and  in  some  cases  thousands,  of  person-days  are  required  to  repair  substantial 
damage  (an  estimated  23,000  for  a  seriously  damaged  boiler).  Most  major 
repairs  require  not  only  small  tools  and  welders  but  also  heavy  cranes  and 
hoists.  Transporting  heavy  items  such  as  generator  rotors  and  transformers  is 
an  exacting  task  when  transport  systems  are  working  normally.  In  the  event  of 
widespread  disruption,  it  could  prove  impossible.  Such  items  as  large  trans¬ 
formers,  for  which  spares  are  often  too  costly  to  keep,  must  nowadays  be 
returned  to  the  manufacturer  for  many  repairs.  "Interchangeability  of  major 

equipment  is  generally  not  possible  due  to  severe  matching  problems.  Thus, 
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repair  or  replacement  of  such  components  will  pose  a  major  post-[nuclear]- 
attack  problem."  [ id . : 60 ] 

Another  estimate  (Chenoweth  etal.  1963:38-41]  suggests  that  a  minimum  of 
several  weeks  would  be  needed  to  restore  a  modestly  damaged  power  station  to 
operation  under  ideal  conditions  (absolute  availability  of  expertise,  labor, 
money,  parts,  etc.,  no  radiation  or  other  interfering  conditions,  no  conflic¬ 
ting  priorities).  The  history  of  even  minor  repairs  in  high-radiation-field 
areas  of  nuclear  plants — some  welds  have  required  hundreds  of  welders  over  a 
period  of  months,  each  exposed  to  the  quarterly  limit — suggest  that  it  would 
not  take  much  contamination,  whether  radiological  or  chemical,  to  complicate 
repairs  enormously  and  even  to  exhaust  available  pools  of  skilled  workers.  For 
some  types  of  repairs  to  damaged  energy  systems,  e.g.  for  replacing  large  tubu¬ 
lar  steel  in  oil  and  gas  systems,  manufacturing  capacity  is  already  strained  to 
keep  up  with  routine  demand,  let  alone  the  exigencies  of  large-scale  emergency 
repairs.  (Pipe  over  about  12"  is  normally  special-order,  as  are  the  large 
motors  and  other  special  components  associated  with  it  [Stephens  1973:20,34, 
96].)  If  Mideast  oil  systems  suffered  major  pipe  damage,  digging  up  existing 
U.S.  pipelines,  cutting  them  into  sections,  flying  them  to  the  stricken  area, 
and  rewelding  them  might  be  faster  than  manufacturing  new  pipe.  Needs  for 
equipment  and  trained  personnel,  too,  would  dwarf  any  standby  capability — as 
was  arguably  the  case  when,  during  the  Three  Mile  Island  accident,  industry 
experts  from  around  the  world  converged  on  Middletown.  Stephens  :  i v]  notes 
that  automation  has  so  reduced  the  number  of  field  employees  in  the  oil  and  gas 
industry  "that  the  system  could  not  suddenly  revert  to  hand  operation",  and 
that  since  most  company  repair  crews  have  been  disbanded  in  favor  of  special¬ 
ized  contractor  crews,  "Should  a  number  of  areas  be  damaged  at  once,  they  could 
not  be  repaired  in  any  suitable  time  to  serve  an  emergency."  Recovery  from 
limited  damage  is  hard  enough;  damage  to,  say,  several  refineries  in  the  same 
area  would  be  "a  catastrophe";  damage  to  many  throughout  the  country  would  be 
virtually  unrepairable  [_i_d  .  :  1 50 ;  Fernald  1965]. 

If  facilities  are  so  damaged  that  they  must  be  substantially  rebuilt  or 
replaced,  construction  lead  times  (neglecting  any  regulatory  approval  periods) 
would  probably  not  be  much  shorter  than  in  routine  practice — of  the  order  of 
5-6  years  for  a  sizeable  coal-steam  power  plant  or  8  years  for  a  nuclear  plant. 
(Subsequent  chapters  will  contrast  this  nearly  irreducible  lead  time — a  func¬ 
tion  of  the  scale  and  complexity  of  the  technologies — with  lead  times  which  are 
orders  of  magnitude  shorter  for  many  dispersed  alternatives.)  Elaborate  plants 
also  require  exotic  materials  and  fabrication  techniques  whose  availability 
assumes  that  the  highly  interdependent  industrial  economy  is  intact  and  flour¬ 
ishing.  A  single  nuclear  power  plant,  for  example,  includes  in  its  replaceable 
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core  components  [Energy  &  Defense  Project  1980:7]  109  metric  tons  (T)  of  chrom¬ 
ium,  2.65  T  of  gadolinium,  at  least  55  T  of  nickel,  24  T  of  tin,  and  1106  T  of 
hafnium-free  zirconium.  Other  major  energy  facilities  show  heavy  dependence  on 
potentially  scarce  and  frequently  imported  materials  [Goeller  1980:81-84].  They 
also  depend  on  an  industrial  infr- structure  whose  scale,  concent  rat i on ,  reli¬ 
ance  on  advanced  materials  inputs  and  electronics  and  on  automation  and  exotic 
skills,  disincentives  to  inventories,  and  energy-  and  cap i ta 1- intens i ty  are  a 
recipe  for  vulnerability  [Joint  Committee  on  Defense  Production  1977:11:42-44]. 

In  summary:  if  an  energy  source  fails,  its  connections  with  a  supply  grid 
may  provide  help  (backup  and  restarting)  or  may  merely  propagate  the  failure — a 
dilemma  addressed  further  in  Chapter  4.4.  If  a  whole  interdependent  energy 
system  collapses,  the  need  of  component  A  to  have  energy  from  B  and  vice  versa 
if  either  is  to  operate  can  only  enmesh  recovery  efforts  in  rapidly  spreading 
chaos.  The  wider  interdependencies  of  the  stricken  energy  system  on  materials 
and  equipment  drawn  from  an  energy-dependent  industrial  system  may  prove  even 
more  awkward.  Seen  in  microcosm  by  a  utility  engineer  trying  to  bootstrap  up 
the  critical  path  to  recovery,  inability  to  get  spare  parts  from  a  local  ware¬ 
house  is  a  local,  specific  obstacle.  But  from  a  macro  point  of  view  [Dresch  & 
Ellis  1966:11-12],  thousands  of  similar  localized  discontinuities  in  a  previ¬ 
ously  seamless  web  of  industrial  relationships  could  collectively  signal  its 
unraveling  on  a  national  or  even  a  global  scale.  Only  if  materials,  skills, 
and  equipment  are  locally  available  to  cope  with  disruptions  can  there  be  con¬ 
fidence  of  keeping  that  web  coherent  and  coordinated.  Crucial  to  that  availa¬ 
bility  is  information  that  enables  people  and  organizations  on  the  spot  to  har¬ 
ness  their  latent  ingenuity.  This  theme  will  recur  in  later  chapters  as  we  ex¬ 
plore  the  accessibility  of  different  technologies  to  potential  improvisers. 

2 .4.  The  cost  of  failure. 


The  dependence  of  modern  industrial  societies  on  continuous,  highly  reli¬ 
able  supplies  of  high-grade  energy  is  a  relatively  recent  phenomenon.  The 
Netherlands  today  uses  about  as  much  oil  as  all  Western  Europe  did  in  1950.  We 
are  accustomed  to  suppose  that  civilization  would  be  impossible  with,  say,  only 
half  as  much  oil  and  gas  as  we  use  today;  yet  the  OECD  countries  used  only  half 
as  much  as  recently  as  1960,  when  they  were  at  least  half  as  civilized  as  now. 
Ironically,  much  of  today's  vulnerability  arose  from  efforts  to  escape  an 
earlier  one:  much  of  the  impetus  behind  the  U.S.  shift  to  oil  and  gas  was  the 
memory  of  the  1919  coal  strike,  and  current  reliance  on  highly  vulnerable  gas 
pipelines  (Chapter  3)  was  a  response  to  World  War  II-era  vulnerabilities  of 
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coastal  oil  shipments  to  U-boats  and  of  railroad  coal  shipments  to  labor 
problems  [Congressional  Research  Service  1977:1:7-9].  The  precariousness  of 
international  oil  trade  is  well  known — thanks  to  inadequate  preparation  and 
panic  buying,  a  1%  reduction  in  world  oil  availability  arising  from  the  Iranian 
revolution  in  early  1979  caused  gasoline  lines  and  a  120%  price  increase  in  the 
U.S. — but  the  cost  of  failure  could  be  even  higher  in  a  post-oil  economy  if  the 
measures  taken  to  relieve  oil  dependence  are  themselves  unreliable. 

The  frequency  and  duration  of  major  supply  failures  is  fairly  well  known. 
For  example,  over  the  past  decade  about  60  significant  failures  of  bulk  elec¬ 
trical  supply  have  been  reported  per  year,  averaging  about  250  MW  each,  with  a 
1250-MW  or  roughly  100,000-customer  interruption  occurring  about  once  a  year. 
The  1977  New  York  blackout,  because  complete  restoration  took  25  hours,  headed 
the  list  of  severity  (the  product  of  MW,  customers,  and  hours)  with  388  bil¬ 
lion,  but  the  16  May  1977  Florida  blackout  of  1.3  million  customers  (3.2  GW) 
for  4.5  hours,  with  an  index  of  19  billion,  was  far  from  negligible,  and  sever¬ 
al  other  interruptions  were  nearly  as  severe,  including  one  in  March  1976  that 
left  parts  of  Wisconsin  blacked  out  for  as  long  as  nine  days  [Economic  Regula¬ 
tory  Administration  1981:Ch.  4]. 

But  while  there  are  plentiful  statistics  on  the  size,  frequency,  duration, 
and  location  of  supply  failures,  estimating  their  cost  to  society  is  difficult 
and  controversial.  This  is  not  surprising.  There  is  no  theoretical  basis  for 
quantifying  the  value  of  delivering  a  unit  of  energy  [Lovins  1977;  Junger 
1976],  Quantifying  the  value  of  a  unit  not  delivered  raises  even  thornier 
problems.  Not  all  kilowatt-hours  or  barrels  of  oil  are  created  equal:  the  lack 
of  one  may  cost  a  life  while  the  lack  of  another  may  lose  no  benefit  at  all. 

The  direct  costs  may  be  high  in,  say,  agriculture  if  the  failure  prevents  a 
harvest  or  causes  the  mass  suffocation  of  ventilation-dependent  hogs  or  poul¬ 
try;  yet  on  another  farm  or  at  another  time  of  year  the  damage  may  be  negligi¬ 
ble.  Analyses  of  outage  costs  commonly  assume  that  failure  to  serve  a  10-kW 
demand  is  ten  times  as  important  as  failure  to  serve  a  1-kW  demand  [Glassey  & 
Craig  1978:  336],  but  this  may  well  be  untrue  in  both  economic  and  human  terms, 
Duration,  degree  of  warning,  and  foreknowledge  of  likely  duration  are  also  im¬ 
portant.  Although  there  is  a  large  literature  of  efforts  to  quantify  electri¬ 
cal  outage  costs  [Economic  Regulatory  Administration  1981:Ch.  5],  the  results 
are  highly  subjective,  fail  to  capture  many  important  features  of  heterogeneous 
demands,  and  range  over  nearly  two  orders  of  magnitude.  Further,  where  does 
one  draw  the  boundary  for  a  cost  analysis?  At  lost  income,  life,  health,  com¬ 
fort,  crops,  industrial  production,  gross  national  product  (the  usual  basis  for 
estimates  [Aspen  Institute  1980:62]  that  the  1976-77  oil  interruptions  cost 
America  about  $20  billion)?  At  consequential  looting  [Newsweek  1977]?  How  can 
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one  handle  downstream  economic  consequences?  In  the  1977  coal  strike,  for 
example.  Congressman  Brown  of  Ohio  suggested  to  the  Secretary  of  Labor  [Subcom¬ 
mittee  on  Energy  &  Power  1978:3]  that  "there  is  imminent  danger  of  having 
lights  go  out  across  the  State  of  Ohio,"  only  to  be  told,  "That  is  not  a 
national  emergency."  But  Rep.  Brown  then  went  on  to  state  that  "the  entire 
[U.S.]  economy  will  grind  to  a  halt  very  quickly  without  Ohio's  glass,  rubber, 
steel,  and  thousands  of  other  component [ s] ... ."  If  he  were  right,  where  would 
one  draw  the  line  in  calculating  the  costs  of  the  coal  strike? 

The  13-14  July  1977  New  York  blackout  again  offers  a  useful  window  into 
the  social  complexity  of  energy  supply  failures.  Early  estimates  of  direct 
costs — made  up  39%  of  riot  damage,  24%  of  national  economic  costs,  and  the  rest 
of  various  social  and  economic  costs — totalled  some  $310  million  [Congressional 
Research  Service  1978a],  or  7%  of  a  national  average  GNP-day.  Con  Ed's  Chair¬ 
man  thought  that  figure  too  low  [  Subcommittee  on  Energy  &  Power  1978a:142].  He 
was  probably  right.  A  more  realistic  estimate  might  be  of  the  order  of  $1  bil¬ 
lion,  or  about  $100  per  person  throughout  the  blacked-out  area.  The  social 
brittleness  that  made  intolerable  "an  outage  of  any  period  of  time  in  certain 
areas  of  our  city"  [Subcommittee  on  Energy  &  Power  1977:69]  appeared  in  uncon¬ 
trollable  riots — although  in  the  1965  Northeast  blackout,  the  New  York  crime 
rate  had  actually  declined  [ Congressional  Research  Service  1978a :3],  and  the 
Chairman  of  the  Federal  Energy  Regulatory  Commission  stated  [Subcommittee  on 
Energy  &  Power  1978a: 16]  that  "In  the  more  than  200  major  bulk  power  interrup¬ 
tions  which  have  occurred  throughout  the  country  over  the  past  seven  years,  the 
1977  New  York  blackout  was  the  only  one  recording  a  significant  degree  of 
social  losses." 

On  one  level,  the  damage  was  tidied  up:  the  City  administration  "sees 
actual  benefits  in  that  the  [1977]  blackout  led  to  forming  stronger  merchants' 
associations  and  anti-crime  programs"  [Newsweek  1978:18],  and  after  more  than 
3000  arrests,  over  a  thousand  looters  were  eventually  convicted  and  sentenced 
[J_d . ] .  But  class-action  suits  charging  gross  negligence — one  totalling  $10 
billion  (Subcommittee  on  Energy  &  Power  1978a:ll]) — continued  to  haunt  Con  Ed. 

A  Small  Claims  Court  judge  ruled  that  the  utility  "must  reimburse. . .complain¬ 
ants  [mostly  for  food  spoilage]  unless  the  company  can  prove  it  was  not  guilty 
of  negligence"  [Newsweek  1978:18].  The  suits,  including  one  by  the  City  to 
recover  its  expenses  from  Con  Ed,  proceeded  to  trial  [Podgers  1980],  with 
"severe  implications"  for  the  utility  industry  if  the  plaintiffs  succeeded,  in 
effect,  in  "making  the  utilities  insurers  of  public  safety."  And  the  most 
lasting  and  severe  effects  may  indeed  be  the  unquant i fiable  loss  of  confidence 
in  the  City's  social  future  [Newsweek  1977]  and  in  the  institutions  supposed  to 
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protect  its  residents  from  such  complete  breakdown  of  social  order — much  as  the 
most  lasting  effects  of  the  Iranian  hostage-taking  may  turn  out  to  be  loss  of 
public  confidence  in  our  government's  ability  to  foresee  and  forestall  hostile 
foreign  actions.  Such  a  psychological  shock  is  deep  and  lasting,  and  can 
change  what  people  do  far  more  than  can  mere  economic  signals.  For  example,  in 
Britain,  for  several  years  after  the  1974  coal  strike,  more  electrical  genera¬ 
ting  capacity  was  installed  privately — in  the  form  of  expensive  standby  genera¬ 
tors  in  homes  and  factories — than  publicly,  simply  because  many  people  placed 
a  very  high  premium  on  not  being  turned  off. 

The  financial  consequences  of  failure  can  be  catastrophic  for  particular 
companies  or  for  whole  industries.  Recent  DC-10  crashes,  some  of  which  cast 
doubt  on  the  maker's  design  and  on  the  quality  of  FAA  airworthiness  procedures, 
are  apparently  damaging  Douglas's  commercial  prospects,  and  seem  to  have  caused 
heavy  financial  losses  for  airlines  with  major  DC-10  investments  as  some  people 
seek  to  travel  on  other  aircraft  instead.  Three  Mile  Island  may  be  the  end  of 
the  Babcock  &  Wilcox  nuclear  enterprise,  may  well  push  General  Public  Utilities 
over  the  brink  of  insolvency,  has  reduced  the  NRC's  credibility,  and  has 
focused  investors'  attention  on  the  possibility  of  catastrophic  loss  in  an 
industry  that  was  already  having  trouble  attracting  funds  [Emshwiller  1980],  A 
single  event  may  seal  the  fate  of  an  industry  that  is  already  financially  pre¬ 
carious  and  has  little  safety  margin  left  for  maneuver.  Such  far-reaching 
financial  consequences,  like  the  political  costs  of  energy  failures,  profoundly 
affect  the  range  and  quality  of  energy  options  available  to  our  society,  and 
thus  affect  in  turn  the  resilience  of  energy  supply. 

This  chapter  has  considered  the  generic  vulnerabilities  of  modern  energy 
systems.  They  are  diverse  and  certainly  worrisome.  But  specific  elements  of 
those  systems  have  unique  vulnerabilities  that  are  often  even  worse.  We  next 
examine  these  special,  technology-specific  problems  in  Chapter  3,  as  a  basis 
for  abstracting  in  Chapter  4  some  elements  of  a  design  science  of  resilience. 
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3.  DISASTERS  WAITING  TO  HAPPEN:  SOME  SPECIAL  ENERGY  VULNERABILITIES 


Traditional  assessments  consider  separately  the  safety  of  ■'nergy  systems 
(whether  they  are  likely  to  harm  their  neighbors)  and  their  re  l . ability 
(whether  they  are  likely  to  stop  working).  The  previous  chapter  suggests  that 
for  modern  energy  systems  of  large  scale,  cost,  complexity,  and  interdepen¬ 
dence,  the  latter  is  already  a  serious  problem.  But  the  hazards  inherent  in 
some  energy  facilities  are  such  that  loss  of  their  energy  supply  could  be  the 
least  of  our  worries:  other  side-effects  of  their  failure  could  be  an  unparal¬ 
leled  calamity.  This  chapter  will  examine  several  case-studies  illustrating 
this  point,  and  will  amplify  earlier  remarks  about  the  ease  with  which  certain 
components  can  be  disrupted,  whether  accidentally  or  deliberately. 

Dependence,  both  for  energy  supplies  and  for  public  safety,  on  the  inte¬ 
grity  of  inherently  hazardous,  easily  disrupted  energy  facilities  raises  not 
only  technical  but  social  questions.  These  have  received  most  attention  in  the 
context  of  commitments  to  nuclear  power:  Weinberg  [1973],  for  example,  saw  a 
need  "to  examine  whether  our  social  visions  match  our  technological  inventive¬ 
ness."  His  social  visions  included  "a  cadre  that,  from  now  on,  can  be  counted 
upon  to  prevent  accident,  prevent  diversion***in  Uganda  as  well  as  in  the  USA, 
in  Ethiopia  as  well  as  in  England",  exercising  "great  vigilance  and  the  highest 
levels  of  quality  control,  continuously  and  indefinitely"  [Kneese  1973],  Edsall 
[1974]  skeptically  noted  that  "People  are  forgetful,  often  they  are  irrespon¬ 
sible,  and  quite  a  few  of  them  suffer  from  deep-seated  irrational  tendencies  to 
hostility  and  violence."  These  tendencies  would  have  to  be  rigorously  pruned 
from  the  population  of  specialists  responsible  for  the  vulnerable  energy  devi¬ 
ces;  they  "must  not  make  serious  mistakes,  become  inattentive  or  corrupt ,  dis¬ 
obey  instructions,  or  the  like...:  their  standard  of  personal  conduct  must 
differ  markedly  from  historical  norms  for  the  general  population...."  [Lovins 
&  Price  1975:16]  Hannes  Alfv£n  [1972]  puts  it  more  bluntly:  "No  acts  of  God 
can  be  permitted."  Maintaining  such  exacting  standards  of  personal  responsi¬ 
bility  and  protecting  the  technical  systems  from  people  with  lower  standards 
would  be  difficult  in  a  society  that  had,  for  example,  overwhelming  commercial 
or  political  pressures,  or  social  tensions  that  could  give  rise  to  fanaticism 
or  to  guerrilla  movements  or  to  strikes  by  key  personnel.  These  broad  con¬ 
straints  may  imply  an  unwelcome  degree  of  homogeneity  enforced  by  strict  social 
controls — a  concern  already  reflected  in  an  extensive  professional  literature 
[e.g.  Royal  Commission  on  Environmental  Pollution  1976;  Justice  1978;  Barton 
1975;  Ayres  1975;  Grove-White  6  Flood  1976;  Sieghart  1979].  Thus  the  price  of 
some  energy  technologies  may  be  the  very  liberties  in  pursuit  of  which  the 
United  States  was' founded. 
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The  impact  of  human  fallibility  and  malice  on  hazardous,  essential,  and 
highly  engineered  systems  is  not  at  root  an  engineering  problem  but  a  people 
problem.  It  arises  because  the  world  is  peopled  by  human  beings  rather  than  by 
angels  and  robots.  Whether  the  resulting  failures  can  be  kept  small  enough 
without  an  undesirable  degree  of  social  engineering — whether  the  degree  of 
control  required  to  protect  fragile  technical  systems  is  acceptable  in  a  free 
society — is  a  profound  political  issue  beyond  the  scope  of  this  study.  However, 
differences  of  opinion  on  this  very  question  are  a  prime  source  of  discontent 
with  the  introduction  of  such  technologies  and  hence  make  them  a  source  of 
unrest  and  perhaps  a  potential  victim  of  disruption. 

These  problems,  too,  are  not  static,  but  evolve  as  society  evolves.  If 
strong  compensatory  mechanisms  do  not  turn  up,  it  is  at  least  plausible  that 
"fallibility  problems ...[ wi 11 ]  become  more  prominent  as  [vulnerable  systems]... 
proliferate,  salesmen  outrun  engineers,  investment  conquers  caution,  routine 
dulls  conmi tment ,  boredom  replaces  novelty,  and  less  skilled  technicians  take 
over  (especially  in  countries  with  little  technical  infrastructure  or  tradi¬ 
tion."  [Lovins  &  Price  1975:17-18]  Already,  A1 fv£n  and  others  have  noted  a 
marked  decline  in  the  quality  of  nuclear  engineering  students  in  the  United 
States,  so  a  dollar  invested  in  solving  outstanding  problems  will  buy  less 
solution  in  the  future  than  it  did  in  the  days  of  the  pioneers. 

Even  if  standards  of  care  can  be  meticulously  maintained,  there  is  no 
guarantee  that  the  biggest  source  of  risk  has  thereby  been  dealt  with.  Risk 
assessments  normally  assume  that  failures  are  caused  only  by  random  mechanical 
breakdowns  and  human  errors,  but  in  fact  deliberate  attempts  to  cause  failures 
may  be  far  more  important.  Human  intention,  which  brings  technical  systems 
into  being,  can  also  disrupt  them.  Generally  a  much  lower  technology  is  needed 
to  make  disorder  than  order.  Whether  intention  is  malicious  or  reflects  mere 
curiosity  and  playfulness,  its  effect  is  the  same.  Abrahamson  [1974]  points 
out  that  vastly  more  aircraft  have  crashed  by  intention  than  by  accident.  Given 
"the  inherent  frailty  of  a  technology  that  puts  hundreds  of  people  in  a  cylin¬ 
der  of  aluminum  moving  at  600  mph  some  seven  miles  up  in  the  air,"  it  is  mainly 
the  limited  incentive  to  make  a  civilian  airliner  crash,  not  any  security  sys¬ 
tem,  that  protects  them.  Unfortunately,  as  subsequent  examples  will  show,  the 
incentives  for  violence  against  certain  energy  systems  are  enormously  greater 
than  those  for  violence  against  airliners.  We  can  appreciate  the  importance  of 
those  incentives  only  by  examining  more  closely  where  and  how  they  arise. 

3.1.  Liquefied  natural  gas  systems. 
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Long-distance  pipelines — for  example,  from  Algeria  to  Italy — are  not  a 
feasible  way  to  export  surplus  natural  gas  from  major  fields  to  customers  over¬ 
seas.  A  high-technology  way  to  do  this  has,  however,  been  developed  in  the 
past  few  decades.  The  gas  is  chilled  in  a  costly  facility  into  liquid  form  at 
a  temperature  of  -260*F  (-162*C),  increasing  its  density  by  a  factor  of  approx¬ 
imately  620.  The  colorless,  odorless,  intensely  cold  liquefied  natural  gas 
(LNG)  is  then  transported  at  approximately  atmospheric  pressure  in  special 
cryogenic  tankers — the  costliest  nonmilitary  seagoing  vessels  in  the  world — to 
a  regasification  facility,  nearly  as  complex  and  costly  as  the  liquefaction 
plant.  When  needed,  LNG  can  be  taken  from  insulated  storage  tanks  and  recon¬ 
verted  to  gas.  Approximately  60  "peak-shaving"  plants  in  North  America  also 
liquefy  and  store  domestic  natural  gas,  simply  as  a  cushion  against  winter  peak 
demands  which  could  otherwise  exceed  pipeline  capacity.  LNG  from  either  source 
is  regasified  and  distributed  to  customers  by  pipeline  just  like  wellhead  gas. 

One  cubic  meter  of  LNG  weighs  465  kg  (less  than  half  the  density  of  water) 
and  has  an  energy  content  of  238  therms  (23.8  million  BTU)  or  25.1  G J ,  equival¬ 
ent  to  about  4.3  barrels  of  crude  oil.  A  barrel  of  LNG  thus  has  about  0.7  the 
energy  content  of  a  barrel  of  oil.  Yet  it  is  potentially  far  more  hazardous 
[Comptroller  General  of  the  U.S.  1978  (hereinafter  cited  as  GAO);  Davis  1979; 
Office  of  Technology  Assessment  1977].  A  barrel  of  burning  oil  cannot  spread 
very  far  on  land  or  water,  but  a  barrel  (0.159  cubic  meters)  of  LNG,  because  it 
is  620  times  denser  than  pure  natural  gas  and  because  that  in  turn  mixes  with 
surrounding  air,  can  make  over  67,000  cubic  feet  (1910  cubic  meters)  of  highly 
flammable  gas-air  mixture.  A  single  modern  LNG  tanker  of  125,000  cubic  meters 
carries  the  equivalent  of  2.7  billion  cubic  feet  of  gas  or  about  20-50  billion 
cubic  feet  of  flammable  air-gas  mixture  (the  flammability  limits  of  natural  gas 
in  air  are  about  5-14%).  A  10,000-ton  LNG  spill  on  water  will  probably  boil  to 
gas  in  about  5  minutes  [Fay  1980:89).  That  gas,  moreover,  is  so  cold  that  it 
is  denser  than  air,  and  flows  in  a  cloud  or  plume  along  the  surface  until  it 
reaches  an  ignition  source.  Such  a  plume  might  extend  at  least  5  km  downwind 
from  a  large  tanker  spill  within  10-20  minutes  [Williams  1971,1972].  It  might 
ultimately  reach  much  further — perhaps  10-20  km  (6-12  miles)  [GAO  1:12-15].  If 
not  ignited,  the  gas  is  asphyxiat ing.  If  ignited,  it  will  burn  to  completion 
with  a  turbulent  diffusion  flame  reminiscent  of  the  1937  Hindenberg  disaster 
but  about  a  hundred  times  as  big.  Such  a  cloud  of  flame  can  be  blown  through  a 
city,  creating  "a  very  large  number  of  ignitions  and  explosions  across  a  wide 
area.  No  present  or  foreseeable  equipment  can  put  out  a  very  large  [LNG]... 
fire."  [GAO  I:exec.  summ.  25].  The  energy  content  of  a  single  125,000-m^ 

LNG  tanker  is  equivalent  to  0.7  megatons  or  about  55  Hiroshima  bombs. 
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A  further  hazard  of  LNG  is  that  its  extreme  cold  causes  most  metals  to 
lose  ductility,  become  brittle,  and  contract  violently.  If  LNG  spills  onto 
ordinary  metals  (that  is,  those  not  specially  alloyed  for  such  low  tempera¬ 
tures),  such  as  the  deck  plating  of  a  ship,  it  often  causes  instant  brittle 
fractures.  Thus  failure  of  the  special  membranes  that  contain  the  LNG  in  tanks 
or  tankers  could  bring  it  into  contact  with  ordinary  steel — the  hull  of  a  ship 
or  the  outer  tank  of  a  marine  vessel — and  cause  it  to  unzip  like  a  banana 
[Thomas  &  Schwendtner  1972;  Dobson  1972],  a  risk  most  analyses  ignore  [Fay 
1980:96].  LNG  can  also  seep  into  earth  or  into  insulation  (the  cause  of  the 
Staten  Island  terminal  fire  that  killed  40  workers  in  1973).  Imperfectly  insu¬ 
lated  underground  LNG  tanks,  like  those  at  Canvey  Island  in  the  Thames  Estuary 
below  London,  can  even  create  an  expanding  zone  of  permafrost,  requiring  the 
installation  of  heaters  to  maintain  soil  dimensions  and  loadbearing  properties. 

The  potential  hazards  of  LNG  are  illustrated  by  the  only  major  LNG  spill 
so  far  experienced  in  the  U.S.  —  in  Cleveland  on  20  October  1944  [GAO  I:exec. 
summ.  25-27],  A  4200-m^  LNG  tank  in  America's  first  peak-shaving  LNG  plant 
collapsed,  and  not  all  the  spillage  was  contained  by  dikes  and  drains.  Escap¬ 
ing  vapors  were  quickly  ignited,  causing  a  second  tank  to  spill  another  2100 
m^.  "The  subsequent  explosion  shot  flames  more  than  half  a  mile  into  the 
air.  The  temperature  in  some  areas  reached  3000°F."  Secondary  fires  were 
started  by  a  rain  of  LNG-soaked  insulation  and  drops  of  burning  LNG  [GAO  1:1 0— 
8].  By  the  time  the  8-alarm  fire  was  extinguished  (impeded  by  high-voltage 
lines  blocking  some  streets),  130  people  were  dead,  225  injured,  and  over  $7 
million  (1944  $)  in  property  destroyed.  An  area  about  a  half-mile  on  a  side 
was  directly  affected,  within  which  30  acres  (12  hectares)  were  gutted,  includ¬ 
ing  79  houses,  2  factories,  and  217  cars.  A  further  35  houses  and  13  factories 
were  partly  destroyed  [GAO  1:10-11].  The  National  Fire  Protection  Association 
Newsletter  of  November  1944  noted  that  had  the  wind  been  blowing  towards  the 
congested  part  of  the  area,  "an  even  more  devastating  conflagration. . .could 
have  destroyed  a  very  large  part  of  the  East  Side."  It  is  noteworthy  that  the 
plant's  proprietors  had  taken  precautions  only  against  moderate  rates  of  LNG 
spillage,  and  did  not  think  a  large,  rapid  spillage  was  possible.  "The  same 
assumption  is  made  today  in  designing  dikes"  around  LNG  facilities  [GAO  I:exec. 
summ.  27].  The  Cleveland  plant,  like  many  today,  was  sited  in  a  built-up  area 
for  convenience;  the  proximity  of  other  industrial  plants,  houses,  storm 
sewers,  etc.  was  not  considered.  Less  than  6300  m3  spilled,  mostly  on 
company  property,  whereas  a  modern  LNG  site  may  have  several  tanks  of  up  to 
95,000  m^  each.  And  the  cascading  series  of  failures  in  two  inner  and  two 
outer  tanks  was  probably  common-mode,  from  a  single  minor  cause  [GAO  1:12-17], 


The  future  of  LNG  in  the  United  States  is  highly  uncertain,  largely  for 
economic  reasons.  LNG  shipment  requires  highly  capital-intensive  facilities  at 
both  ends  and  in  between.  Their  coordination  is  a  logistical  feat  that  exposes 
companies  to  major  financial  risks:  "if  any  of  I  the  system's  components  is  not 
ready  on  time]...,  the  entire  integrated  system  collapses  [Aronson  &  Wester- 
meyer  1981:24).  Like  the  nuclear  fuel  cycle,  LNG  projects  require  exquisite 
timing  but  often  do  not  exhibit  it — as  when  Malaysia  was  "caught  with  finished 
[LNG]  carriers  before  their  fields  and  facilities  were  ready  to  begin  produc¬ 
tion"  [Jd_.  : 2 1  ]  .  This  uninsurable  financial  exposure  by  prospective  LNG  buyers 
provides  a  bargaining  chip  to  sellers,  who  can  simply  raise  the  price  and  dare 
the  buyers  to  write  off  their  tankers,  terminals,  and  regasification  plants. 

This  has  been  happening  in  1980-81.  Algeria,  the  major  LNG  exporter, 
demanded  that  LNG  be  priced  at  oil  parity  ($6/10^  BTU  or  about  $40/bbl), 
more  than  a  trebling  of  earlier  prices.  The  U.S.  government  found  this  price — 
far  above  the  $4. 47/10**  BTU  just  negotiated  with  Canada  and  Mexico — unac¬ 
ceptable.  On  1  April  1980,  Algeria  cut  off  LNG  deliveries  to  the  El  Paso  Natu¬ 
ral  Gas  Company,  idling  its  costly  tankers  and  terminals  at  Cove  Point,  Mary¬ 
land  and  Elba  Island,  Georgia.  Though  modest  imports  from  Algeria  continue  at 
the  older  (1968-71)  Distrigas  operation  in  Everett,  Massachusetts,  which  uses  a 
different  pricing  structure  and  Algerian-owned  ships,  the  Cove  Point  and  Elba 
Island  facilities,  like  the  nearly  completed  Panhandle  Easter  Pipe  Line  Co. 
terminal  at  Lake  Charles,  Louisiana,  sit  as  hostages  to  price  agreement  with 
Algeria.  Algeria  has  somewhat  moderated  its  initial  demands,  but  it  and  other 
LNG  exporters  still  intend  to  move  rapidly  to  oil  parity.  Partly  for  this 
reason,  the  proposed  Point  Conception  (California)  LNG  terminal  seems  unlikely 
to  be  built.  The  economic  difficulties  of  LNG  arise  in  not  only  the  world  but 
also  the  domestic  marketplace:  new  and  probably  existing  LNG  imports  cannot 
compete  with  domestic  gas  (let  alone  with  efficiency  improvements  and  some  re¬ 
newable  options),  and  LNG  has  been  saleable  only  by  "rolling  in"  its  high  price 
with  very  cheap  (regulated)  domestic  gas.  Gas  deregulation  will  probably  so 
increase  domestic  supply  and  reduce  domestic  demand  as  to  squeeze  LNG  out  of 
the  market.  Acknowledging  the  bleak  economic  outlook,  El  Paso  in  February  1981 
"wrote  off  most  of  the  equity  ($365.4  million)  in  its  six  tankers  which  hauled 
Algerian  LNG  to  the  East  Coast."  [Aronson  &  Westermeyer  1981:5] 

Despite  these  uncertaint ies,  some  LNG--about  0.1X  of  national  gas  use — is 
new  being  imported  into  the  U.S.,  and  facilities  are  available  for  more.  The 
disturbing  vulnerabilities  of  these  facilities  will  now  be  surveyed — for  tank¬ 
ers,  terminals,  storage  tanks,  and  trucks — together  with  analogous  vulnerabili¬ 
ties  for  liquefied  petroleum  gas  (LPG)  facilities. 
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3.1.1.  LNG  tankers . 

Fourteen  LNG  terminals  are  operable  worldwide.  Some  are  sited  in  major 
conurbations,  including  Boston  Harbor  and  Tokyo  Harbor.  (Another,  built  in 
Staten  Island,  New  York,  has  remained  mothballed.)  In  1978  the  world  fleet 
contained  38  specially  insulated,  double-hulled  tankers  of  several  designs 
[GAO],  with  an  average  LNG  capacity  of  46,000  m^.  By  1980  this  fleet  was 
stabilizing  at  about  80  tankers  [Fay  1980:90],  the  largest  of  165,000  m^ — 
"enough  to  cover  a  football  field  to  a  depth  of  130  feet"  [id.: 2—7 ) .  A  modern 
standard  LNG  tanker  of  about  125,000  m^  is  about  1000  feet  (305  m)  long, 

150  feet  (46  m)  abeam,  and  cruises  at  20  knots,  partly  fueled  by  the  0.13-0.25% 
of  the  cargo  that  boils  off  each  day.  LNG  tankers  carry  unique  safety  equip¬ 
ment  and  are  subject  to  special  rules,  usually  involving  escorts  and  traffic 
restrictions,  when  moving  in  harbor.  Once  moored,  a  tanker  discharges  its  LNG 
cargo  in  10-15  hours  at  a  rate  up  to  190  m^  per  minute  (equivalent  to  about 
75  GWt,  or  the  rate  at  which  about  70  giant  power  stations  send  out  ener¬ 
gy).  The  pipes  used  in  this  operation  are  exposed  on  the  jetty,  and  lead  to  at 
least  two  tankers 1 -worth  of  storage  tanks  contained  (with  limitations  noted 
below)  by  dikes.  A  typical  LNG  storage  tank,  of  which  most  terminals  have 
several,  is  140  feet  high  by  190  feet  in  diameter  (43  x  58  m)  and  holds  95,000 
m^  of  LNG  with  a  heat  content  of  2.4  PJ — equivalent  to  a  quarter  of  an 
hour's  total  energy  consumption  for  the  entire  United  States,  or  to  the  energy 
released  in  a  nuclear  explosion  of  569  kT  (over  40  Hiroshima-equivalents) . 

LNG  tankers  have  a  good  safety  record,  but  even  the  limited  reports  avail¬ 
able  show  some  spills  [GAO;  Davis  1979],  One  LNG  carrier  has  gone  aground,  and 
three  failed  certification  owing  to  cracked  insulation  [Aronson  &  Westermeyer 
1981].  Double-hulled  LNG  tankers  (unlike  single-hulled,  pressurized  LPG  tank¬ 
ers)  are  relatively  resistant  to  damage  by  collision  or  light  attack,  but  could 
be  holed  by  certain  weapons  available  to  international  terrorists  (or  by  mili¬ 
tary-type  limpet  mines).  Onboard  sabotage  would  be  relatively  straightforward. 
Manipulation  of  onboard  valves  could  in  some  circumstances  rupture  the  LNG 
tanks  from  overpressure  [GAO  1:6-10,-11,-59,-60].  Alternatively,  all  LNG  tank¬ 
er  designs  allow  internal  access  below  the  tanks,  and  if  a  tank  were  deliber¬ 
ately  ruptured,  ducts  open  at  both  ends  and  running  the  full  length  of  the 
cargo  area  would  help  to  distribute  liquid  [GAO  1:9-21].  Any  such  substantial 
spillage  of  LNG  onto  the  steel  hull  would  probably  shatter  it.  "Only  an  expert 
would  recognize  some  types  of  explosive  material  as  explosives.  One  LNG  ship 
crew  member,  trained  in  the  use  of  explosives,  could  cause  simultaneous  tank 
and  hull  damage ... [wh ich ]  might  initiate  an  extremely  hazardous  series  of 
events."  LPG  ships  are  even  more  easily  sabotaged  [GAO  1:9-20], 
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3.1.2.  LNG  terminals  and  storage  tanks. 

The  enormous  amounts  of  LNG  and,  if  it  leaks,  of  flammable  vapors  make  LNG 
terminals  and  storage  areas  highly  vulnerable.  The  world's  largest  LNG  gasifi¬ 
cation  plant,  the  $4+-billion  facility  at  Arzew,  Algeria,  narrowly  escaped  de¬ 
struction  one  night  a  few  years  ago  when  a  gas  cloud  from  a  leaking  tank  drift¬ 
ed  through  it  and  dispersed  without  igniting.  The  Tokyo  Harbor  terminal  has 
luckily  escaped  involvement  with  marine  fires  and  explosions,  including  at 
least  one  major  one  from  an  LPG  tanker.  The  Canvey  Island  terminal  downriver 
from  central  London  recently  had  its  third  narrow  escape  when  a  200,000-ton  oil 
tanker  collided  with  a  Shell  oil  jetty  at  Coryton  that  protrudes  into  the  river 
upstream  of  it  [Times  1981];  when  the  Italian  freighter  Monte  Ulia  had  sheared 
off  that  same  jetty,  the  resulting  drift  of  burning  oil  and  trash  barges  down¬ 
river  had  narrowly  missed  the  LNG  jetty  (Davis  1979].  Indeed,  one  actual  and 
one  suspected  incident  of  arson  aboard  a  Texaco  tanker  had  also  endangered  the 
Canvey  Island  LNG  terminal  [BBC  1981].  Though  the  Cove  Point,  Maryland  LNG 
terminal  is  sited  away  from  population  centers,  it  is  3  miles  south — well  with¬ 
in  plume  range — of  the  Calvert  Cliffs  nuclear  power  plant,  which  probably  could 
not  withstand  a  major  firecloud.  The  Everett  Distrigas  terminal  in  Boston 
Harbor  is  near  Logan  Airport,  and  its  ship  channel  lies  under  the  flight  path 
for  at  least  one  runway.  A  Delta  DC-9  on  an  instrument  landing  crashed  into 
the  seawall  short  of  that  runway  in  1973.  Had  a  gas  tanker  been  in  the  channel 
at  the  time,  it  could  have  been  missed  by  as  little  as  a  few  feet.  A  normal 
flight  pattern  can  bring  in  planes  as  low  as  100  feet  above  an  LNG  ship's  masts 
[GAO  1 : 6—39 f f ] ,  though  the  FAA  now  plans  to  suspend  landings  that  would  do  so. 

Both  the  terminals  and  the  far  more  numerous  peak-shaving  LNG  plants — in 
1978  the  U.S.  had  45  of  these  ^storing  over  23,000  m^,  or  3.6  times  the 
total  spill  in  the  1944  Cleveland  disaster — are  vulnerable  to  natural  disasters 
or  to  sabotage.  A  GAO  evaluation  of  five  LNG  and  LPG  sites  found  that  at 
three,  tanks  had  very  small  earthquake  safety  margins;  "two  of  these  three 
sites,  including  three  large  tanks,  are  located  next  to  each  other  in  Boston 
Harbor."  [GAO  I:exec.  summ.  8]  About  5%  of  all  earthquakes  have  occurred  in 
areas  with  little  known  seismic  history  or  active  faulting.  Boston  experienced 
a  major  quake  of  this  kind  in  1755.  (Others  at  Charleston,  South  Carolina  and 
New  Madrid,  Missouri  in  1876  and  1811-12  respectively  were  felt  over  an  area  of 
two  million  square  miles.)  The  origin  of  such  quakes  is  unknown  [GAO  1 : 3—12 f ] . 

Contrary  to  normal  practice  in  Japan,  where  LNG  tanks  are  underground, 

U.S.  tanks  are  above-grade.  GAO  calculations  and  experiments  suggest  that  most 
dikes  meant  to  contain  minor  leaks  from  these  tanks  will  in  fact  fail  to 
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contain  at  least  half  of  any  sudden,  major  spill,  and  some  thin  dikes  could 
fail  altogether  [GAO  I:Ch.  5],  Sudden,  massive  releases  are  indeed  possible, 
as  in  Cleveland  in  1944,  because  "if  the  inner  tank  alone  fails  for  any  reason, 
it  is  almost  certain  that  the  outer  tank  will  rupture  from  the  pressure  and 
thermal  shock"  [J_cL:exec.  summ.  8].  Further,  estimates  of  the  critical  crack 
lengths  above  which  a  large,  fully  loaded  LNG  tank  would  fail  catastrophically 
range  from  a  conservative  maximum  of  4.5-8. 5  feet  (GAO)  to  1-1.5  feet  (Columbia 
LNG  Corp.,  for  the  usual  9%  nickel  alloy  steel  cylindrical  tanks)  [GAO  I:Ch. 

4].  Actual  critical  crack  lengths  could  be  smaller,  but  have  not  been 
determined  by  detailed  calculation  or  experiment. 

This  proneness  to  brittle  fracture  implies  that  relatively  small  disrup¬ 
tions  by  sabotage,  earthquake,  tornado  missiles,  etc.  could  well  cause  immedi¬ 
ate,  massive  failure  of  an  above-grade  LNG  tank.  GAO  [1:9-3]  notes  that  the 
equipment  stolen  from  National  Guard  armories  includes  "small  arms,  automatic 
weapons,  recoilless  rifles,  anti-tank  weapons,  mortars,  rocket  launchers,  and 
demolition  charges.  A  large  number  of  commercially  available  publications 
provide  detailed  instructions  on  the  home  manufacture  of  explosives,  incendiar¬ 
ies,  bombs,  shaped  charges,  and  various  other  destructive  devices.  All  the  re¬ 
quired  material  can  be  bought  at  hardware  stores,  drug  stores,  and  agricultural 
supply  outlets. .. .It  is  not  unusual  for  international  terrorist  groups  to  be 
armed  with  the  latest  military  versions  of  fully  automatic  firearms,  anti-air¬ 
craft  or  anti-tank  rockets,  and  sophisticated  explosive  devices."  But  GAO  also 
found  that  such  sophistication  would  not  be  necessary  to  cause  a  major  LNG 
release.  Live  firing  tests  [I:9-12f]  "confirmed  that  the  double-wall  structure 
of  [LNG] .. .tanks  affords  limited  protection  even  against  non-military  small 
arms  projectiles,  and  that  devices  used  by  terrorists  could  cause  a  catastro¬ 
phic  failure  of  the  inner  wall."  Some  tanks  allow  access  to  the  insulation 
space  through  ground-level  manholes,  or  are  built  in  the  air  on  pilings,  thus 
greatly  increasing  the  effectiveness  of  explosive  charges.  Single-walled  metal 
tanks,  commonly  used  for  LPG,  can  be  readily  destroyed  by  small  charges. 

In  1978,  none  of  the  16  LNG  facilities  visited  by  GAO  had  an  alarm  system, 
many  had  poor  communications  and  backup  power  sources,  guarding  was  minimal 
(often  one  unarmed  watchman),  and  procedures  were  lax:  "Access  to  all  of  the 
facilities  we  visited  would  be  easy,  even  for  untrained  personnel."  [  id . : 9-lM  . 
GAO  sums  up  the  sabotage  risk:  "Successful  sabotage  of  an  LEG  [liquefied  enei — 
gy  gas,  e.g.  LNG  and  LPG]  facility  in  an  urban  area  could  cause  a  catastrophe. 
We  found  that  security  procedures  and  physical  barriers  at  LEG  facilities  are 
generally  not  adequate  to  deter  even  an  untrained  saboteur.  None  of  the  LEG 
■»  f  >rage  tanks  we  examined  are  impervious  to  sabotage,  and  most  are  highly 
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vulnerable."  Further,  "In  many  facilities,  by  manipulating  the  equipment,  it 
is  possible  to  spill  a  large  amount  of  fluid  outside  the  diked  area  through  the 
draw-off  lines.  LEG  storage  facilities  in  cities  are  often  adjacent  to  sites 
that  store  very  large  quantities  of  other  hazardous  substances,  including  other 
volatile  liquids.  Thus,  a  single  cause  might  simultaneously  destroy  many 
tanks,  or  a  spill  at  one  facility  might  cause  further  failures  at  adjacent 
facilities"  [id.:exec.  summ.  lOf] — including  refineries  and  power  stations. 

3.1.3.  LNG  shipments  by  truck. 

More  than  75  insulated,  double-walled  trucks  deliver  LNG  from  terminals  to 
over  100  satellite  distribution  tanks  in  31  states  [Fay  1980:91],  chiefly  in 
urban  areas  [GA0:exec.  summ.  16].  More  than  90  truckloads  of  LNG  can  leave  the 
Everett  Distrigas  terminal  in  a  single  day  [GAO  1:7-1].  Though  puncture-resis¬ 
tant,  the  trucks  have  points  of  weakness  and  a  very  high  center  of  gravity,  en¬ 
couraging  rollover  accidents  [GAO  1:7-7).  Each  truck  carries  40  m^  of  LNG, 
with  a  heat  content  equivalent  to  0.26  kT  or  about  1/50  of  a  Hiroshima  yield. 

At  least  twelve  LNG  truck  accidents  had  occurred  in  the  U.S.  by  1978.  Two 
caused  spills  [GAO  I:exec.  summ.  16].  One  driver  blacked  out  after  driving  far 
more  than  permitted  hours  and  falsifying  his  logbook  [_fd_.  :  1 :  7—6  J  .  Luckily, 
both  spills  were  in  rural  areas  and  neither  ignited.  Most  LNG  trucks  leaving 
the  Everett  facility  travel  on  the  elevated  Southeast  Expressway,  a  hazardous 
road  within  a  few  blocks  of  the  crowded  Government  Center  area.  In  the  first 
four  months  of  1977  alone,  there  were  four  serious  accidents  on  the  Southeast 
Expressway  involving  tractor-trai ler  trucks,  one  of  which  fell  off  onto  the 
streets  below  [GAO  1 : 7—7 f ] .  An  LNG  truck  would  almost  certainly  break  open  in 
such  an  accident  [id.].  The  entrances  to  the  Sumner  and  Callahan  Tunnels  are 
about  a  hundred  meters  downhill  from  the  Southeast  Expressway  [J_d.:7-ll],  The 
area  is  also  laced  with  basements,  sewers,  and  subway  tunnels  into  which  the 
invisible,  odorless  vapor  would  quickly  spill.  "The  40  cubic  meters  of  LNG  in 
one  truck,  vaporized  and  mixed  with  air  into  flammable  proportions,  are  enough 
to  fill  more  than  1 1 0  miles  of  6-foot  sewer  line,  or  16  miles  of  a  16-foot  dia¬ 
meter  subway  system" — virtually  the  entire  Boston  subway  system  if  the  gas  ac¬ 
tually  went  that  far  and  if  none  leaked  out  [GAO  I:exec.  summ.  17,  1 : 7— 10 f ] .  An 
LNG  spill  into  a  sanitary  sewer  would  vaporize  with  sufficient  pressure  to  blow 
back  methane  through  domestic  traps  into  basements  [id.: 7-11).  Sewer  explo¬ 
sions  themselves  can  run  for  miles  [Marshall  1981],  even  with  only  a  few  m^ 
of  flammable  liquids  [GAO  1:9-6],  and  have  been  used  for  sabotage  [de  Leon  _e_t_ 
al.  1978:22). 
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LNG  truck  drivers  are  not  properly  identified  nor  are  their  trucks 
inspected  for  bombs  before  loading  [GAO  1:9-17].  Security  is  only  marginally 
better  than  for  potato  trucks  [id.:7-9].  LNG  trucks  are  easily  sabotaged.  The 
double  walls  "are  relatively  thin,. ..and  can  be  penetrated  by  a  fairly  small 
improvised  shaped  charge.  Properly  placed,  such  a  charge  would  cause  LNG  to 
discharge  into  the  insulation  space,  causing  the  outer  jacket  to  fracture  and 
disintegrate.”  [id.:9-19]  The  trucks  normally  operate  on  a  fixed  route  and  are 
an  easy  target.  Further,  a  truck  could  be  hijacked  for  extortion  or  for  mali¬ 
cious  use  of  its  cargo.  It  is  "particularly  dangerous,  because  [it  allows]... 
the  easy  capture,  delivery,  and  release  of  a  large  amount  of  explosive  material 
any  place  the  terrorist  chooses."  [GAO  I:exec.  summ.  18] 

3.1.4,  Analogous  hazards  of  liquefied  petroleum  gas  (LPG) . 

Liquefied  petroleum  gas  (known  in  rural  areas  as  "bottled  gas")  is  pro¬ 
cessed  from  natural  gas  or  crude  oil  and  consists  almost  entirely  of  either 
propane  or  butane,  delivered  directly  as  a  liquid  rather  than  being  regasified 
and  piped  like  LNG.  It  thus  requires  many  small  shipments,  yet  makes  up  approx¬ 
imately  3%  of  all  U.S.  energy  supplies.  Although  its  use  is  far  more  wide¬ 
spread,  well-known,  and  long-standing  than  that  of  LNG,  and  although  in  certain 
respects  it  may  be  even  more  hazardous,  LPG  is  less  well  studied  and  regulated. 

Unlike  methane  (the  main  constituent  of  natural  gas),  propane  and  butane 
liquefy  at  normal  temperatures  if  sufficiently  pressurized — at  60°F  (15. 6*0), 
to  about  110  or  40  pounds  per  square  inch  (7.5  or  2.7  bar)  respectively  [Con¬ 
gressional  Research  Service  1977:111:406].  Alternatively,  they  can  be  lique¬ 
fied  at  atmospheric  pressure  by  cooling  them  to  about  -44°F  and  +31°F  respec¬ 
tively.  About  85%  of  the  LPG  in  bulk  storage  is  kept  under  pressure  in  under¬ 
ground  salt  domes  or  caverns  [GAO  I:exec.  summ.  5];  the  rest  is  stored  above¬ 
ground  in  tanks,  often  small  ones.  In  1978  the  U.S.  had  only  20  aboveground 
LPG  storage  facilities  holding  over  23,000  m^.  Most  LPG  is  transported 
through  some  70,000  miles  of  high-pressure  pipelines,  and  the  rest  via  16,000 
pressurized  rail  cars  (no  LNG  moves  by  rail)  and  25,000  pressurized  tank 
trucks.  A  large  LPG  truck,  like  its  LNG  counterpart,  holds  about  40  m^. 

Being  single-walled  and  under  pressure,  LPG  trucks  are  more  vulnerable  than  LNG 
trucks  to  breakage  through  accident  or  sabotage,  and  they  are  also  more  likely 
to  explode  in  fires  because  they  are  uninsulated  and  their  cargo  creates  very 
high  pressures  by  boiling  when  exposed  to  heat. 

Many  LPG  truck  accidents  have  occurred  worldwide  [Davis  1979].  A  34- 

m^  truck,  for  example,  overturned  in  1973  on  a  mountain  road  above  Lynch¬ 
burg,  Virginia,  creating  a  fireball  about  130  m  in  diameter  [GAO  1:7-12].  In  a 
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far  more  destructive  accident  near  Eagle  Pass,  Texas  in  1975,  a  38-m^  LPG 
tank  broke  loose  from  its  trailer.  Two  explosions  blew  the  front  of  the  tank 
about  500  m  and  the  rear  (in  three  pieces)  some  240  m.  Sixteen  people  were 
killed  and  35  injured  [GAO  1:7-13],  In  West  St.  Paul,  Minnesota,  a  midnight 
LPG  delivery  fire  in  1974  killed  four  people  and  demolished  large  sections  of 
three  apartment  buildings;  the  fire  department's  LPG  emergency  procedures  could 
not  be  used  because  of  snow  [id.:7-14].  Many  LPG  accidents  have  occurred 
through  faulty  repairs,  delivery  procedures,  or  valve  operations  [id.:7-13], 

LPG  railcars,  containing  about  115  m^  each  (0.7  kT  equivalent),  "are 
involved  in  many  of  the  10,000  railroad  accidents  that  occur  in  this  country 
each  year.  There  are  often  more  than  10  consecutive  LPG  cars  on  a  train.  Each 
car  can  form  a  10-second  fireball  about  120  m  in  radius  [Fay  1980:100].  If 
vapors  from  one  LPG  car  ignite,  the  fire  may  rupture  an  unpunctured  car  in  a 
'Boiling  Liquid  Expanding  Vapor  Explosion,'  or  BLEVE  [where  sudden  depressuri¬ 
zation  rapidly  boils  and  expels  the  LPG  as  an  aerosol-vapor-air  mixture].  Each 
fire  and  explosion  contributes  to  the  heating  and  weakening  of  neighboring  cars 
and  makes  additional  explosions  more  likely.  A  BLEVE  can  rocket  a  45,000  pound 
(20  T)  steel  section  of  a  tank  for  a  quarter  of  a  mile.  This  is  what  happened 
in  a  derailment  near  Oneonta,  New  York,  in  1974.  LPG  vapor  from  a  crushed  LPG 
car  quickly  ignited  and  formed  a  fireball.  Fire  fighters  attempting  to  cool 
down  several  other  LPG  cars  were  caught  in  a  subsequent  explosion;  54  were  in¬ 
jured.. ..In  a  1974  railyard  accident  near  Decatur,  Illinois,  an  LPG  railcar  was 
punctured;  the  resulting  cloud  did  not  ignite  immediately,  but  spread  and  then 
exploded  over  an  area  one-half  by  three-quarters  of  a  mile.  [The  blast  was 
felt  45  miles  away:  GAO  1:8-3.]  There  were  7  deaths,  349  injuries,  and  $24 
million  in  damage.  Litter  and  debr i s .. .covered  20  blocks  of  the  city.... LPG 
railcars  travel  through  densely  populated  areas  of  cities,  even  cities  which 
prohibited  LPG  storage."  [GA0:I:  exec,  suram.  19]  Some  100,000  LPG  railcars  are 
moved  each  year  in  the  U.S.  [GAO  1:8-1] .  They  are  only  a  tenth  as  numerous  as 
tankers  carrying  other  hazardous  cargoes,  and  are  thus  likely  to  occur  in  the 
same  trains  with  chlorine,  oil,  industrial  chemicals,  etc.  Railway  switchyards 
have  had  ammunition  trains  blow  up;  a  few  years  ago  a  chemical  tank  car  being 
shunted  in  Washington  State  exploded  with  a  force  of  several  kT.  An  LPG  train 
could  easily  be  derailed  at  any  desired  point;  "youth  gangs  frequently  place 
obstacles  on  tracks  which  delay  freight  trains  in  New  York  City  just  to  harass 
the  trainmen."  [GAO  1:8-14]  The  5/8"  steel  wall  of  an  LPG  railcar  "can  be  eas¬ 
ily  cut  with  pocket  size  explosive  devices  [or  by]  many  other  weapons  commonly 

used  by  terrorists...."  (id.: 9—18 ]  LPG  vapors  are  heavier  than  air  even  at 

'*  — 

ambient  temperatures,  are  flammable  in  about  the  2-9%  range,  and  can  detonate. 
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LPG  terminals,  as  well  as  shipments  by  road  and  rail,  penetrate  the  most 
vulnerable  parts  of  our  industrial  system.  GAO  [1:2-11],  for  example,  shows  an 
aerial  photograph  of  a  major  LPG  receiving  terminal  near  Los  Angeles  Harbor. 

Its  propane  storage  tanks,  a  stone's  throw  from  the  Palos  Verdes  earthquake 
fault,  are  surrounded  on  one  side  by  a  large  U.S.  Navy  fuel  depot  and  by  a  tank 
farm,  and  on  the  other  side  by  a  dense  residential  area  that  runs  for  miles — 
all  within  the  range  of  an  LPG  conflagration.  A  broadly  similar  50,000-m3 
refrigerated  propane  tank  in  Qatar,  designed  by  Shell  International,  suddenly 
collapsed  in  1977,  sending  liquid  propane  over  the  dike;  the  resulting  explo¬ 
sion  destroyed  the  LPG  facility  surrounding  the  tank.  In  France,  eleven  people 
died  and  70  were  injured  when  vapor  from  a  leaking  butane  tank  was  ignited  by  a 
truck  passing  160  m  away,  leading  to  the  explosion  of  eight  butane  and  propane 
tanks  [GAO  1:2 1—6 f ]  .  In  practical  effect,  the  most  densely  industrialized  and 
populated  areas  in  America  have  potential  bombs  in  their  midst,  capable  of 
causing  disastrous  explosions  and  firestorms  without  warning.  "Nuclear  power 
plants,"  as  GAO  remarks  [l:exec.  summ.  8],  "are  built  to  higher  standards  than 
any  other  type  of  energy  installation,  much  higher  than  those  for  LEG  installa¬ 
tions.  Nevertheless,  they  are  never  located  in  densely  populated  areas.  We 
believe  that  new  large  LEG  facilities  also  should  not  be  located  in  densely 
populated  areas."  Even  existing  LEG  facilities  pose  a  formidable  hazard. 

LNG  shipments  and  facilities  likewise  perforate  America's  industrial 
heartland.  Even  the  most  sensitive  "choke  points"  are  put  at  risk.  In  Febru¬ 
ary  1977,  for  example,  LNG  was  trucked  along  the  Staten  Island  Expressway  and 
across  the  Verrazano-Narrows  and  Goethals  Bridges  [_id_.:7-8].  Seven  Mile 
Bridge,  the  only  land  access  to  the  lower  Florida  Keys,  was  heavily  damaged  by 
a  recent  propane-truck  explosion  [Los  Angeles  Times  1981c].  It  is  apparently 
common  for  LNG  shipments  to  pass  near  major  oil,  gas,  and  nuclear  facilities, 
few  if  any  of  which  could  withstand  envelopment  in  a  burning  gas  cloud.  While 
many  local  authorities  would  like  to  restrict  such  shipments  before  a  catas¬ 
trophe,  the  regulation  of  such  interstate  commerce  is  federally  preempted;  and 
so  far,  despite  the  devastating  criticisms  in  the  GAO  report,  the  dozen  or  so 
responsible  Federal  agencies  have  done  little  of  substance  to  improve  safety. 

Perhaps  additional  LNG  imports,  brought  by  80-plus  large  tankers  into  a 
half-dozen  U.S.  terminals,  will  never  happen  as  enthusiasts  once  hoped,  if  only 
for  the  economic  reasons  alluded  to  earlier.  But  unless  tackled  directly,  the 
clear  and  present  dangers  from  present  LNG  and — on  a  far  greater  scale--LPG 
operations  will  persist.  Later  chapters  will  argue  that  all  the  energy  now 
supplied  by  LNG  and  LPG  can  be  replaced  by  much  cheaper  sources  which  do  not 
compromise  preparedness. 
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3.2.  Oil  and  gas  systems. 

Oil,  gas,  and  natural  gas  liquids,  which  together  supplied  about  73%  of 
America's  total  primary  energy  in  1979,  are  transported,  processed,  stored, 
delivered,  and  marketed  by  an  extraordinarily  complex  technical  system  that 
must  rank  among  the  greatest  technical  achievements  of  our  species.  A  veteran 
observer  of  that  system,  however,  notes  in  a  classic  study  [Stephens  1973:62] 
that  "The  system  is  delicately  balanced  and  extremely  vulnerable  and  can  be 
readily  interrupted  or  damaged  by  natural  disasters,  by  sabotage,  or  by  enemy 
attack.  An  attack  concentrated  on  the  system,  or  even  on  certain  segments  or 
fragments  of  it,  could  bring  industrial  activity  and  transportation  to  a 
standstill."  A  followup  study  of  the  natural  gas  system  alone  [Stephens  1974: 

87]  identifies  an  ominous  trend:  "It  is  recognized  that  certain  impalpable 
conditions  exist  that  might  be  quite  subtle  in  nature,  yet  have  the  potential 
of  great  impact  on  the  industry  if  such  were  damaged.  An  attempt  was  made  to 
seek  out  these  conditions  but  it  is  certa’n  that  many  remain  unidentified.  It 
is  also  evident  that  as  the  industry  becomes  more  efficient,  handling  larger 
volumes  of  gas  and  products,  as  flow  lines  extend  farther  seaward  linking  more 
deep  water  platforms,  that  frailty  of  the  system  is  increasing.  There  are 
critical  locations  and  junction  points  that  concentrate  facilities  and  large 
gas  volumes  into  centers  which  are  easy  targets. .. .Unfortunately,  there  appears 
to  be  a  trend  away  from  flexibility  of  the  system. .. .The  Icarian  nature  of 
expansion  of  the  industry  increases  vulnerability  daily." 

The  links  between  the  oil  and  gas  industry  and  other  equally  vulnerable 
systems  are  intricate,  pervasive,  and  increasing.  "Our  present  economy  is  so 
finely  tuned,  because  of  the  need  to  effect  as  much  efficiency  as  possible, 
that  an  interdependence  has  been  developed  between  transportation,  manufac¬ 
turing,  electric  power  generation  and  the  petroleum  and  natural  gas  industry,  [so] 
that  one  can  herdly  exist  without  the  other.  Each  depends  on  and  each  serves 
the  other.  A  widespread  failure  of  one  industry  is  certain  to  seriously  affect 
another.  The  natural  gas  industry  cannot  function  without  pipe,  electric 
motors,  pumps,  chemicals  and  a  host  of  other  items,  nor  can  many  manufacturing 
industries  exist  without  the  products  of  the  gas  system  or  that  of  the  closely 
related  petroleum  system."  [Stephens  1974:79-80]  The  natural  gas  industry 
also  provides  the  feedstock  from  which  is  made  "all  or  most  of  the  rubber, 
plastics,  fertilizer,  paint,  industrial  solvents,  medicines  and  many  other 
items  used  daily  in  the  United  States.  A  loss  of  this  [ feedstock] .. .would  be 
devastating  in  time  of  a  national  emergency."*  f  id .  :4]  The  functioning  of  the 

*60%  of  U.S.  petrochemical  capacity  is  on  the  Texas  Gulf  Coast  [OTA  1979a:69], 


oil  and  gas  industries  in  turn  depends  on  internal  linkages:  "the  links  between 
segments  could  be  the  major  frailty."  [Stephens  1973:136] 

3.2.1.  Oil  and  gas  fields  and  shipping  facilities. 

The  vulnerability  of  the  oil  and  gas  system  begins  (exploration  aside)  at 
the  wellhead  and  in  the  reservoir.  At  a  conservative  $30  per  barrel,  the  oil 
deposits  in  the  Persian  Gulf  region  are  worth  over  $270  trillion  [Taylor  1980: 
307],  or  over  100  U.S.  GNP-years— perhaps  the  ripest  plum  in  the  world.  OPEC 
has  lately  earned  a  negative  real  rate  of  return  on  extracted  oil:  a  barrel 
lifted  in  January  1974  and  sold  for  $11  would  by  1980  have  been  worth  about  $18 
if  invested  in  U.S.  Treasury  bonds,  yet  the  same  barrel  left  in  the  ground 
could  by  1980  have  been  sold  for  at  least  $32  [Foley  &  LBnnroth  1981:7].  But 
even  though  oil  appreciates  (so  far)  faster  in  the  ground  than  in  a  Swiss  bank, 
the  oil  itself  is  in  the  Gulf,  not  in  Switzerland,  and  its  proprietors  under¬ 
standably  worry  that  they  may  not  be  around  to  enjoy  the  future  revenues. 

The  cultural,  political,  and  military  instability  of  the  Gulf  [Deese  &  Nye 
1981]  needs  no  emphasis  here.  Even  friendly,  relatively  stable  exporters  of 
oil  to  the  U.S.  cannot  be  considered  entirely  reliable:  Canada's  current  Pro¬ 
vincial/Federal  tug-of-war  has  already  curtailed  many  Albertan  oil  and  syncrude 
activities.  But  present  U.S.  oil  imports  are  sadly  lacking  even  in  the  safety 
of  diversity.  About  a  third  of  the  non-Communi st  world's  oil  supply  comes  from 
the  Gulf,  and  about  a  third  of  that  in  turn  comes  from  the  highly  congested 
area  at  the  head  of  the  Gulf  (including  Kuwait)  [Rowen  1980].  Within  major 
oil-exporting  countries,  moreover,  there  is  astonishing  physical  concentration. 
One  Saudi  oilfield  lifts  5  million  barrels  per  day— more  than  any  other  country 
except  the  U.S.  and  U.S.S.R.  Saudi  Arabia  lifts  about  9.5  Mb/d  from  a  mere  700 
wells,  whereas  the  U.S.,  far  further  along  in  its  depletion  cycle,  lifts  10.2 
Mb/d  (including  natural  gas  liquids)  from  some  600,000  wells  [Taylor  1980:304], 
The  delivery  systems  for  that  concentrated  gush  of  oil  are  likewise  highly 
localized.  Kemp  [Deese  &  Nye  1981:370]  notes  that  "The  oil  wells  themselves 
are  obvious  targets!;]  so  are  the  collecting  systems,  which  pump  oil  through 
pipes  from  the  fields  to  local  terminal  facilities.  [These]...,  containing 
gas-separation  plants,  local  refineries,  storage  tanks,  and  loading  facilities, 
could  also  be  potential  targets.  And  the  pipelines  and  tankers  carrying  oil  to 
destinations  beyond  the  Gulf  are  no  less  vulnerable."  It  is  often  forgotten 
that  Libya's  leverage  to  begin  the  oil  price  spiral  came  from  the  Suez  Canal 
closure  and  destruction  of  a  pipeline  [Deese  &  Nye  1981:9].  "In  early  1978, 
according  to  Stobaugh  &  Yergin  [1979:36],  "there  were  reports  that  Iraq  was 
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training  frogmen  and  desert  demolition  squads,  and  that  Palestinian  terrorists 
had  been  found  on  tankers."  There  has  been  at  least  one  intelligence  alert 
[Times  1975a]  that  terrorists  were  about  to  rocket  or  hijack  a  supertanker  in 
the  Straits  of  Hormuz — perhaps  the  most  critical  of  several  maritime  bottle¬ 
necks  through  which  tankers  bound  to  main  importing  countries  must  pass.  (No 
more  than  a  few  large  vessels  sunk  there  could  block  the  Straits  for  a  long 
time.)  Other  sensitive  shipping  paths  include  the  Bab-el-Mandeb  Strait  (which 
Egypt  blockaded  in  1973),  Sharm-e 1-She ikh ,  the  Cape  of  Good  Hope,  and  the 
Straits  of  Malacca  and  Singapore.  TAP-Line,  a  0.5-Mb/d  pipeline  opened  in  1950 
from  Saudi  fields  to  the  Zahrani  terminal  near  Sidon,  in  southern  Lebanon  (cur¬ 
rently  a  turbulent  area),  was  repeatedly  attacked  by  saboteurs  and  during  the 
Arab-lsraeli  wars  (it  passes  through  the  Golan  area  of  Syria),  and  was  even¬ 
tually  so  damaged  by  bombings  that  it  was  shut  down  altogether  [SIPRI  1974:55; 
Congressional  Research  Service  1977:111:169].  Even  before  the  1980  outbreak  of 
hostilities  between  Iran  and  Iraq,  Iranian  oil  facilities  had  suffered  severe 
damage  from  sabotage:  a  combination  of  poor  labor  relations,  repression  of  the 
Arab  minority  in  Khuzistan,  and  provocation  of  Iraq  had  led  to  frequent  bomb¬ 
ings  of  pipelines  and  pumping  stations  [ Deese  &  Nye  1981:66],  including  the 
destruction  of  at  least  14  pipelines  within  three  days  [ New  York  Times  1980]. 

Offshore  oil  facilities,  proposed  as  a  replacement  for  OPEC  oil  imports, 
are  nearly  as  vulnerable — sitting  ducks  laden  with  highly  flammable  fuels  under 
pressure  [Kessler  1976;  Kupperman  &  Trent  1979:72].  Scottish  Nationalists  have 
already  bombed  an  onshore  North  Sea  pipeline.  The  British  government's  five- 
ship,  four-plane  task  force  to  patrol  offshore  North  Sea  installations  [Donne 
1975]  is  likely  to  be  ineffectual.  Though  each  platform  has  a  "safety  zone"  of 
500  m,  illegal  trawlers  have  sailed  within  30  m  [Faux  1981]  because  the  fishing 
is  richer  there,  and  there  is  nothing  to  stop  a  vessel  from  actually  attacking 
a  platform.  The  oil  rigs  may  be  vulnerable  to  mere  collisions:  a  rig  in  the 
Norwegian  sector  capsized  in  1980,  killing  123  people,  because  it  could  not 
cope  with  the  collapse  of  one  of  its  five  supports,  which  had  been  weakened  by 
an  improperly  cut  hole  [Washington  Post  1981a]  .  One  $50+-mitlion  platform  may 
carry  over  40  wells  [Stephens  1979:208],  and  junctions  of  gathering  lines  fre¬ 
quently  bring  50-100,000  b/d  or  more  into  a  single,  "totally  unprotected"  line, 
often  in  shallow  water  or  swampy  areas  where  heavy  equipment,  whether  floating 
or  onshore,  cannot  operate  [Stephens  1973:34],  More  than  three  simultaneous 
platform  fires  "would  completely  overwhelm  available  control  and  remedial 
facilities  of  the  Gulf  Coast" — which  could  all  be  bottled  up  by  sinking  a  small 
barge  [Stephens  1974:93].  In  current  practice,  platforms  in  and  along  the  Gulf 
of  Mexico  must  he  shut  in  and  deserted  (as  offshore  platforms  off  New  England 
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would  presumably  have  to  be)  during  severe  storms.  This  interrupts  the  filling 
of  natural  gas  storage,  "depended  upon  more  each  year  for  peak  load  cushions," 
and  might  lead  to  widespread  shortages  if  a  late  hurricane  in  the  Gulf  coincid¬ 
ed  with  an  early  cold  spell  in  gas-heated  areas  [Congressional  Research  Service 
1977:111:193].  Three  North  Sea  gas  platforms  and  a  drill  rig  have  been  tempor¬ 
arily  shut  down  by  a  mere  hoax  telephone  threat  [ Guard i an  1975b]. 

The  vulnerability  of  oil  imports  can  also  interact  with  that  of  the  domes¬ 
tic  oil  systems  which  would  have  to  substitute  for  interdicted  imports.  If, 
for  example,  crude  oil  imports  to  East  Coast  refineries  were  shut  off,  virtual¬ 
ly  the  only  fluid  fuel  supplies  to  the  Northeast  would  come  through  one  refined 
products  pipeline  (Colonial)  and  a  few  natural  gas  pipelines — all  of  which 
could  be  disabled  by  a  handful  of  people.  The  48-inch  Trans-Alaska  Pipeline 
System  (TAPS),  currently  supplying  1.2  million  b/d  (10.5%  of  U.S,  refinery 
runs)  and  displacing  oil  imports  worth  nearly  $500  per  second,  is  an  equally 
tempting  leverage  point.  It  runs  aboveground  through  remote  country  for  800 
miles,  and  there  is  no  other  way  to  deliver  its  North  Slope  oil.  Though  its 
proprietors  annually  spend  about  a  thousandth  of  the  line’s  replacement  cost  on 
obvious  security  precautions,  it  is  impossible  to  prevent  determined  sabotage. 

Major  parts  of  TAPS  are  invisible  and  inaccessible  to  repair  crews  by  air 
or  ground  for  up  to  weeks  at  time  in  the  winter.  "If  this  almost  uniquely 
vulnerable ...  system  were  interrupted  for  three  weeks  [in  winter],  the  heated 
oil  [nine  million  barrels  of  it]  would  cool  to  the  point  that  it  could  not  be 
moved,  putting  the  pipeline  out  of  service  for  six  months."  TAPS  was  bombed  in 
1977  without  penetrating  the  pipe  wall,  but  a  second  bombing  in  February  1978 
spilled  about  15,000  barrels  and  shut  down  the  line  for  21  hours  [Comptroller 
General  of  the  U.S.  (hereinafter  cited  as  GAO)  1979:30].  (Alyeska's  security 
manager  still  "does  not  perceive  a  sabotage  threat  in  Alaska."  1 )  The 
vulnerability  of  the  eight  pumping  stations,  remotely  controlled  from  Valdez, 
was  illustrated  in  July  1977  when  operator  error  blew  up  a  station  in  a  rela¬ 
tively  flat  area.  After  10  days,  the  station  was  bypassed  and  pumping  resumed, 
at  half  the  usual  rate;  but  had  the  failed  station  been  one  of  those  required 
for  pumping  over  the  mountains,  pipeline  capacity  "would  have  been  reduced  sub¬ 
stantially  more,  or  even  curtailed  altogether."  [GAO:39]  "Despite  an  intense 
rebuilding  effort,  it  took  about  9  months  to  rebuild  the  pump  station."  [ id . ] 

In  a  less  favorable  location  or  season,  it  would  have  taken  longer.  A  Senate 
Subcommittee  [Senate  Judiciary  Committee  1977]  "was  stunned  at  the  lack  of 
planning  and  thought  given  to  the  security  of  the  pipeline  before  it  was  built" 
[Congressional  Research  Service  1977:111:169]  and  recommended  that  DOE  set  up 
an  Office  of  Energy  Security.  The  Bill  died  and  was  not  reintroduced. 
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Oil  imported  to  the  contiguous  United  States  other  than  from  Alaska  or 
Canada  arrives  by  tanker:  some  directly  in  the  small  and  medium-sized  tankers 
that  can  enter  conventional  ports,  and  the  rest,  directly  or  indirectly,  in 
vast,  lumbering  Very  Large  Crude  Carriers.  That  these  vessels  are  vulnerable 
to  disruption  needs  no  emphasis,  as  they  managp  now  and  then  to  do  themselves 
in  without  assistance  [Mostert  1974]. 

3.2.2.  Oil  storage  and  refineries;  gas  processing  plants. 


The  average  barrel  of  oil  takes  about  three  months  to  get  from  the  well¬ 
head  to  a  final  U.S.  user  (Marshall  1980].  Along  the  way  are  oil  inventories 
"in  the  pipeline" — aboard  rankers,  in  various  tanks,  and  of  course  in  pipelines 
themselves.  According  to  Petroleum  Intelligence  Weekly  [Federation  of  American 
Scientists  1980:6],  however,  about  3.3  billion  barrels  of  oil  worldwide,  or 
nearly  two  months'  world  oil  use,  represent  an  "absolute  minimum  unusable  quan¬ 
tity"  needed  to  fill  pipelines  and  otherwise  keep  distribution  systems  flowing. 
A  further  0.5  and  0.8  billion  barrels  are  respectively  held  in  stockpiles 
requiring  a  political  decision  for  their  release  and  in  ships  on  route  to  their 
destinations.  Thus  only  stocks  in  excess  of  about  4.6  billion  barrels  world¬ 
wide  "can  be  considered  commercially  usable  inventory."  In  late  1980  the  inven¬ 
tory  was  around  5.7  billion  barrels,  about  0.4  billion  above  normal  —  four  times 
the  amount  then  held  in  the  U.S.  Strategic  Petroleum  Reserve.  These  stocks 
provide  a  degree  of  elasticity  to  the  tightly  coupled  world  oil  system. 

Oil  stockpiles,  however,  are  vulnerable:  indepd,  the  Strategic  Petroleum 
Reserve  appears  to  be  the  only  Federal  energy  project  in  the  U.S.  which  has 
from  the  start  been  careful  to  minimize  its  vulnerability  through  appropriate 
security  measures,  analyses,  siting,  stocking  of  spare  parts,  etc.  (The  below¬ 
ground  storage  caverns  are  of  course  relatively  well  protected;  only  the  sur¬ 
face  installations  are  of  much  concern.)  That  these  precaut ions  were  not  idle 
was  borne  out  in  Rhodesia  in  mid-December  1978  when  Black  nationalists  using 


rockets  and  tracer  bullets  burned  out  a  40-acre  oil  storage  depot  outside  Sal¬ 
isbury,  destroying  half  the  complex  and  nearly  half  a  million  barrels  of  pro¬ 
ducts  which  the  embargoed  Smith  regime  had  painstakingly  accumulated  from  Iran 
and  from  synthetic-oil  plants  in  South  Africa.  The  monetary  cost  alone,  about 


$20  million,  increased  the  projected  national  budget  deficit  by  18%  [New  York 
Times  1978b, c).  A  1972  Palestinian/Red  Brigades  attack  crippled  the  Trieste 
refinery,  burning  out  four  huge  storage  tanks  (Bass  et  al  .  1980:44;  Sterling 
1978:41].  Even  the  U.S.  is  not  immune:  a  St.  Paul,  Minnesota  oil  tank  farm  was 


bombed  on  4  November  1970  [Burnham  1975:122]. 
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Oil  refineries  are  typically  the  most  vulnerable,  capital-intensive,  and 
indispensible  element  of  the  oil  system  downstream  of  the  wellhead.  Since  most 
devices  are  equipped  to  burn  specific  refined  products,  not  crude  oil  itself, 
it  is  not  possible  to  substitute  other  modes  for  refining  as  it  is  for  oil 
delivery.  Just  as  three-fourths  of  domestic  oil  is  lifted  in  only  four  states 
[Stephens  1979:208],  so  more  than  69%  of  refinery  capacity  is  clustered  in  six 
states,  and  over  half  in  only  three  states  (Texas,  California,  Louisiana)  [ id . : 
208].  Of  nearly  300  major  refineries,  22  sites  have  1-3.6%  of  national  capa¬ 
city  each.  Many  of  these  depend  on  common  pipelines,  ports,  and  repair  facili¬ 
ties.  Essentially  all  the  sites  are  subject  to  hazards  ranging  from  earthquake 
to  nuclear  or  LNG  accident  to  military  attack.  Local  concentrations  are 
remarkably  heavy:  for  example  [Stephens  1973:148-149,52],  East  Baton  Rouge  Parish 
Louisiana,  contains  the  then  largest  U.S.  oil  refinery  (Exxon,  0.5  million  bbl/d 
— Baytown,  Texas  is  now  0.6),  many  petrochemical  plants,  Kaiser  Aluminum, 
docks,  river  terminals,  and  two  major  river  bridges.  Through  the  same  area  run 
the  Plantation  and  Colonial  pipelines,  carrying  most  of  the  East  Coast's  and 
much  of  the  South's  refined  products.  A  nuclear  bomb  on  New  Orleans  could 

simultaneously  kill  most  of  its  inhabitants  (including  many  with  unique  technic 
.  . 
cal  skills),  flood  the  city,  destroy  control  centers  for  offshore  oi  l^gpeZ-gas 

operations,  destroy  many  petroleum  company  headquarters,  stop  traffic  both 
across  and  on  the  Mississippi  River  (isolating  petroleum  workers  from  their 
homes  or  plants,  depending  on  the  time  of  day),  damage  a  shipyard  and  refiner¬ 
ies,  and  destroy  port  facilities.  The  Office  of  Technology  Assessment,  working 
with  the  Defense  Civil  Preparedness  Agency,  found  [OTA  1979a:64]  that  destruc¬ 
tion  of  the  77  largest  U/S.  oil  refineries  would  eliminate  two-thirds  of  U.S. 
refining  capacij^'and  "shatter  the  American  economy" — as  well  as  destroying,  in 
the  assuntpd'oO-warhead  nuclear  attack,  3-5  million  lives  and  many  ports,  petro¬ 
chemical  plants,  and  other  heavy  industrial  facilities. 

It  does  not  take  a  one-megaton  warhead,  however,  to  destroy  a  refinery:  a 
handful  of  explosives,  or  sometimes  just  a  wrench  or  the  turning  of  a  valve, 
will  do  as  well.  Refineries  are  congested  with  hot,  pressurized,  highly  flam¬ 
mable,  and  often  explosive  hydrocarbons.  "There  are  over  two  hundred  sources 
of  fire  in  an  average  refinery,  so  uncontained  gases  have  little  trouble  find¬ 
ing  an  ignition  source."  [Stephens  1973:52]  Heavy  pressure  vessels  may  them¬ 
selves  explode  if  shocked  [id.].  "Loosened  flange  bolts  in  a  hydrogen  line, 
moving  a  gas  that  burns  with  a  colorless  flame  and  which  even  in  a  small  mass, 
auto-detonates  at  relatively  low  temperature,  could .. .completely  destroy  vital 
segments  of  a  refining  process.  A  broken  valve  bonnet  in  an  iso-butane  line  or 
an  overflowing  hot  oil  tank  has  been  known  to  cause  millions  of  dollars  damage." 
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[_id.  :101]  Some  parts  of  the  refinery  are  essential  to  its  working  at  all;  so 
tf  a  crucial  third  of  the  plant  is  destroyed,  output  may  be  reduced  to  zero, 
not  merely  by  a  third  [_id_.:141],  Refineries  involve  such  complex  plumbing  and 
equipment,  often  custom-made,  that  repairs  are  slow  and  difficult:  reconstruc¬ 
tion  of  substantial  equipment  can  take  months  [Stephens  1970:105]  or  years. 

Stephens  [Jd_.  :vii]  lists  recent  trends  which  have  tended  to  make  refiner¬ 
ies  more  vulnerable.  His  concerns  include:  the  push  to  enlarge  plants  within 
the  same  boundaries,  so  increasing  congestion;  localization  of  capacity,  espec¬ 
ially  in  areas  "having  frequent  hurricanes,  tornadoes,  floods  and  earthquakes, 
and  by  or  near  tide  water";  making  more  light  products,  which  require  the  use 
of  highly  explosive  hydrogen  aifd  make  process  control  more  critical  and  equip¬ 
ment  "more  sensitive  to  possible  detonations";  widespread  dependence  on  pur¬ 
chased  electricity,  even  for  vital  functions;  reliance  on  centralized,  hard-to- 
repair  computers;  reduction  of  the  work  force,  leaving  fewer  skilled  people  (or 
people  of  any  description)  on  site  to  cope  with  emergencies;  reduced  spare- 
parts  inventories;  relatively  flimsy  construction,  especially  in  control  and 
switchgear  houses,  cooling  equipment,  and  exposed  piping  and  cables;  larger 
storage  tanks  and  supertankers;  and  bigger  terminals  with  higher  unloading 
rates,  "resulting  in  a  concentration  of  highly  combustible  products  and  crude 
supply  into  a  relatively  small  area."  A  more  volatile  set  of  trends  is  hard  to 
imagine.  Nor  is  refinery  sabotage  a  mere  fantasy:  on  26  January  1970,  the 
"United  Socialist  Revolutionary  Front"  caused  "millions  of  dollars"  in  damage 
to  four  units  of  the  Humble  refinery  in  Linden,  New  Jersey  [New  York  Times 
1970]  .  The  national  disruption  from  refinery  outages  could  be  maximized  by 
careful  selection  of  the  targets,  since  U.S.  refinery  flexibility  is  unusually 
low  [Deese  &  Nye  1981:40],  Flexibility  could  be  improved  through  overcapacity, 
as  is  currently  the  case — in  spring  1981,  refinery  utilization  was  at  an  all- 
time  low  of  about  68%  [Martin  1981] — but  the  cost  of  that  inadvertent  redundan¬ 
cy  is  far  higher  than  the  industry  would  ever  incur  intentionally. 

Natural  gas  processing  plants,  analogous  to  (though  simpler  than)  oil 
refineries,  are  a  similar  point  of  weakness,  and  have  in  fact  also  been  sabo¬ 
taged:  the  Black  September  group  blew  up  two  such  plants  in  Rotterdam  on  6 
February  1971  [Energy  &  Defense  Project  1980:15]*.  Unlike  crude-oil  refining, 
gas  processing  is  not  an  absolutely  vital  step  in  the  short  term,  and  can  be 
temporarily  bypassed  [Stephens  1974:27],  But  this  cannot  be  long  continued, 
for  three  reasons.  First,  dissolved  natural  gas  liquids  can  cause  transmission 
problems,  and  if  not  extracted,  can  remain  in  gas  delivered  to  final  users; 

"the  sudden  onrush  of  'gasoline'  out  of  gas  burners  could  be  very  dangerous." 

*Fifty  heavily  armed  rightists  also  took  over  and  threatened  to  blow  up  a  re¬ 
mote  Bolivian  gas  processing  plant  of  Occidental  Petroleum  Co.  in  May  1981,  but 
left  for  Paraguay  after  several  days'  negotiations  [Los  Angeles  Times  1981i]. 
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[  id.  :  1 5 ]  Second,  unextracted  water  could  "freeze  and  cause  considerable  damage 
at  low  spots  in  the  line"  [id.],  and  makes  traces  of  hydrogen  sulfide  or  carbon 
dioxide  highly  corrosive  to  pipelines  [id.:24].  Third,  unprocessed  gas  is  more 
hazardous:  it  often  contains  highly  toxic  hydrogen  sulfide,  and  the  presence 

of  even  small  amounts  of  low-flashpoint  higher  hydrocarbons  will  vastly  extend 
the  flammable  and  explosive  limits  of  gas-air  mixtures.  Some  common  impurities 
are  so  flammable  that  the  mixture  can  be  ignited  by  a  "static  spark  or  one  made 
by  imbedded  sand  in  a  person's  shoe  sole  striking  the  rungs  of  a  steel  ladder" 
[id.  :87,90]  .  Gas  processing,  then,  cannot  be  omitted  for  long  without  grave 
occupational  and  public  risks.  Yet  gas  processing  plants  are  at  least  as 
vulnerable  as  refineries,  take  a  year  and  a  half  to  rebuild  "assuming  normal 
delivery  of  equipment  and  materials"  [Jd_.  :27],  and  are  often  centralized.  A 
single  plant  in  Louisiana,  the  world's  largest,  provides  1.85  billion  cubic 
feet  per  day  to  the  East  Coast — the  equivalent  of  over  20  huge  power  stations' 
output  [Stephens  1973:149]),  or  about  3.4%  of  America's  total  natural  gas  use 
(which  is  in  turn  a  fourth  of  total  energy  use).  An  alarming  84%  of  all  inter¬ 
state  gas  is  from  Louisiana  (53%)  or  flows  from  Texas  mostly  via  Louisiana 
(31%) :  Louisiana  is  to  U.S.  gas  as  OPEC  is  to  world  oil  [Stephens  1979]. 

3.2.3.  Pipelines  and  alternatives. 

Oil  pipelines  move  about  three- fourths  of  the  crude  oil  used  by  U.S.  re¬ 
fineries  and  about  one-third  of  the  refined  products  moved  from  refineries  to 
consumers.  These  pipelines  "are  highly  vulnerable  to  disruptions  caused  by 
human  error,  sabotage,  or  nature.  Damage  to  key  facilities  on  just  a  few  pipe¬ 
line  systems  could  greatly  reduce  domestic  shipments,  causing  an  energy  short¬ 
age  exceeding  that  of  the  1973  Arab  oil  embargo"  [GAO  1979:  i].  The  flow  of 
petroleum  through  just  the  Trans-Alaska,  Colonial,  and  Capline  pipeline  systems 
is  equivalent  to  about  three-fourths  of  total  U.S.  petroleum  imports,  or  over 
1.5  times  the  maximum  U.S.  import  shortfall  during  the  1973  oil  embargo,  or 
about  8  times  U.S.  imports  from  Iran  when  those  were  stopped  in  1978  [id.: 34 ] . 

"Pipelines,"  remarks  John  Jimison  [Congressional  Research  Service  1977: 
111:159-160],  "carry  huge  quantities  of  energy. ..in  continuous  operations 
stretching  over  thousands  of  mi les . . . . [They]  were  constructed  and  are  operated 
with  almost  no  regard  to  their  vulnerability  to  persons  who  might .. .desire  to 
interfere  with  this  vital  movement  of  fuel.  They  are  exposed  and  all  but  un¬ 
guarded  at  innumerable  points,  and  easily  accessible  even  where  not  exposed 
over  virtually  their  entire  routes .... [Tjh i s  vulnerabi 1 i ty  of  the  most  important 
energy  transportation  systems  of  the  Nation  threatens  the  national  security." 
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Jimison  continues:  "Although  all  forms  of  energy  movement  are  vulnerable 
to  some  extent,  pipelines  are  perhaps  uniquely  vulnerable.  No  other  energy 
transportation  mode  moves  so  much  energy,  over  such  great  distances,  in  a  con¬ 
tinuous  stream  whose  continuity  is  so  critical  an  aspect  of  its  importance." 
While  continuity  is  even  more  important  in  electric  transmission,  Jimison  is 
certainly  right  about  both  the  density  and  distance  of  energy  flow  in  pipelines 
— both  the  123,000  miles  (in  1975)  of  crude  oil  and  refined  product  transmis¬ 
sion  lines  and  the  187,233  miles  (in  1975)  of  principal  gas  pipelines.  The 
liquid-  and  gas-carrying  pipelines  have  both  shared  and  unique  vulnerabilities; 
those  not  mentioned  in  the  previous  chapter  will  now  be  surveyed. 

As  Jimison  says  [ id 166-167)  ,  "Little  can  be  done  to  stop  a  determined, 
well-equipped,  and  knowledgeable  saboteur  or  terrorist"  from  disrupting  a  pipe¬ 
line,  since  "It  would  not  be  feasible  to  monitor  the  entire  length  of  a  pipe¬ 
line  frequently  enough  to  prevent  any  action,"  and  virtually  "no . . . securi ty 
precautions  were  taken  in  that  safer  day  when  most . . .pi  pel ines  were  built."  It 
is  nonetheless  important  to  understand  both  the  potential  contributions  and  the 
inherent  limitations  of  such  security  measures  as  can  be  taken. 

Gas  and  oil  pipelines,  ranging  up  to  48"  (122  cm)  in  diameter,  and  fre¬ 
quently  laid  in  parallel  groups  on  the  same  right-of-way,  are  welded  from  steel 
using  special  specifications  and  procedures.  They  are  ordinarily  buried  in  a 
6-foot  trench,  enough  to  protect  them  from  bad  weather  but  not  from  earthquake 
or  ground  shock:  major  pipelines  in  such  seismic  areas  as  St.  Louis,  Lima 
(Ohio),  Socorro,  and  Salt  Lake  City  appear  to  be  at  risk  :  1 9  5  ]  .  The  main 
cause  of  damage  to  buried  pipelines  has  so  far  been  accidental  excavation, 
implying  that  deliberate  excavation  is  also  possible.  (It  could  be  done 
instantaneously  with  military-type  shaped-charge  excavating  devices.)  Mainly 
to  prevent  accidental  damage,  buried  pipelines  are  clearly  marked,  especially 
at  road  and  waterway  crossings,  as  required  by  law.  Extremely  detailed  maps 
periodically  published  by  Federal  agencies  and  by  the  petroleum  industry — some 
scaled  at  1.5  million  to  1  or  less — enable  anyone  to  locate  pipelines  and 
allied  facilities  without  difficulty. 

Merely  penetrating  a  pipeline  may  interrupt  its  flow  and  cause  a  fire  or 
explosion,  but  unless  it  allows  air  into  a  gas  line  in  explosive  proportions, 
the  damage  will  be  local  and  probably  repairable  in  a  few  days  or  (if  the  in¬ 
dustry  had  to  cope  with  several  substantial  breaks  simultaneously)  weeks.  Pipe¬ 
lines  can  be  penetrated  or  severed  using  low  technology — for  example  with  ther¬ 
mite  or  improvised  shaped  charges.  Commercially  available  shaped  charges  are 
used  in  the  oil  and  gas  industry  itself  for  perforating  pipe,  and  have  appar¬ 
ently  been  used  against  pipelines  or  tanks  by  saboteurs  [Stephens  1973:142). 
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Even  if  a  pipeline  were  somehow  completely  destroyed,  it  could  be  relaid 
at  a  substantial  rate:  "under  the  most  favorable  circumstances,  small-diameter 
lines  of  6  to  8  inches  can  be  constructed  as  rapidly  as  3  miles  or  more  per 
day,  and  large-diameter  lines  of  30  to  36  inches  at  one  mile  or  more  per  day. 
Under  extremely  adverse  conditions  the  [respective]  rates. ..are  3,000  to  4,000 
feet  per  day  [ and]  . . . 1 ,000  to  1,500  feet  per  day."  [Goen  et  al .  1970:69-70] 
(Rates  in  swampy  areas  are  often  much  lower.)  But  far  more  vulnerable  and  less 
repairable  than  pipelines  themselves  are  their  prime  movers — pumping  stations 
for  oil,  compressor  stations  for  gas — and  such  allied  facilities  as  intercon¬ 
nections,  metering  and  control  stations,  and  input  terminals.  River  crossings, 
either  on  a  bridge  or  under  the  riverbed,  are  similarly  vulnerable  and  compli¬ 
cate  repair;  further,  dropping  the  bridge  can  at  the  same  time  stop  navigation 
(including  tankers  and  barges  associated  with  an  oil  terminal  or  refinery), 
block  traffic,  and  hinder  the  delivery  of  repair  equipment  [Stephens  1973:46, 
96,101].  Significant  damage  at  any  of  these  points  can  reduce  or  stop  fuel 
flows  for  a  half-year  or  more  [GAO  1979:15;  Stephens  1974:v,91], 

As  the  earlier  TAPS  example  illustrates,  the  impact  of  damage  to  a  pumping 
station  depends  on  the  terrain.  Depending  on  the  lift  required,  the  distance 
between  oil  pumping  stations  can  vary  from  a  few  miles  in  mountainous  country 
to  nearly  200  miles  on  the  flats  [Goen  et  al .  1970:60].  Because  the  engines 
and  pumps  are  very  large  (thousands  of  horsepower)  and  not  a  stock  item,  and 
because  some  "may  be  specifically  designed  for  a  particular  system,"  replace¬ 
ment  can  take  from  a  half-year  to  a  year  [GAO  1979:22,24].  Meanwhile,  pipeline 
flow  may  be  reduced  by  a  third  or  more  or  even  halted.  Damage  to  successive 
stations  in  line,  or  to  one  preceding  a  high  lift,  would  be  most  harmful. 

Stephens  notes  [1973:34]  that  "Pipelines  are  easy  to  sabotage.  A  double 
premium  accrues  to  the  saboteur's  account — the  loss  of  oil  and  an  extensive 
fire  that  might  ensue.  A  trained  group  of  a  few  hundred  persons  knowledgeable 
as  to  the  location  of  our  major  pipelines  and  control  stations  and  with  de¬ 
struction  in  mind  could  starve  our  refineries  from  crude."  Likewise,  Goen  et 
al .  [1970:62-64],  in  a  nuclear  targeting  exercise,  calculated  that  the  destruc¬ 
tion  of  8  terminals,  68  pump  stations,  27  combined  terminal/pump  stations,  and 
23  adjacent  pipelines  would  disable  all  1968-69  U.S.  refined-product  distribu¬ 
tion  pipelines  down  to  and  including  6",  isolating  the  refining  areas  from 
agricultural  and  industrial  areas.  But  in  fact,  immense  mischief  could  be  done 
by  only  a  few  people  if  they  picked  the  right  targets  from  the  copious  litera¬ 
ture  available.  Goen  et  al .  start  in  this  direction  in  noting  that  only  six 
hits  could  disrupt  pipeline  service  between  the  main  extraction  areas  and  the 

East  and  Midwest.  But  in  fact  the  concentration  is  even  greater  than  that 
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might  indicate.  GAO  [1979]  focuses  on  only  three  pipelines:  TAPS,  already 
described,  Colonial  (mentioned  in  Chapter  2.1.7),  and  Tapline.  These  three 
together  contain  less  than  3%  of  American  oil  pipeline  mileage,  yet  carry  about 
18%  of  national  crude  oil  consumption  and  12%  of  refined  product  consumption. 

The  Colonial  system  dominates  the  U.S.  refined-products  pipeline  market, 
carrying  about  half  of  its  total  barrel-miles  [Goen  et  al .  1970:62]  in  4600 
miles  of  pipe  over  a  1600-mile  span.  Its  products  supply  more  than  half  the 
refined-product  demand  in  seven  states  (VA,  NJ ,  NC,  MD ,  TN ,  SC,  GA] ,  15-50%  in 
five  more  (AL,  DC,  MI,  NY,  PA)  [GAO  1979:15].  "Other  pipelines  or  transporta¬ 
tion  modes  cannot  absorb  enough"  to  replace  this  flow  [  id . : i  i  i  ]  .  Tapline,  a 
40-inch,  632-mile,  16-pump-station  crude  oil  pipeline  shipping  1.2  Mb/d  from 
St.  James,  Louisiana  to  Patoka,  Illinois,  provides  a  quarter  of  the  input  to 
Midwestern  refineries,  is  likewise  irreplaceable,  and  is  the  largest  of  three 
distribution  conduits  to  be  used  by  the  Strategic  Petroleum  Reserve.  Capline 
plus  TAPS  ship  2.4  Mb/d  of  crude — nearly  a  fifth  of  all  U.S.  refinery  runs. 

Colonial,  Tapline,  and  other  U.S.  pipelines  have  been  and  probably  still 
are  startlingly  vulnerable  to  sabotage.  In  findings  reminiscent  of  the  state 
of  nuclear-plant  physical  security  in  the  mid-1960s,  GAO  found  appalling  laxity 
— and  little  managerial  consciousness  of  sabotage  risks  [GAO  1979:30] — at  many 
key  pipeline  facilities.  The  main  Capline  input  terminal,  for  example,  de¬ 
scribed  by  a  company  official  as  a  most  crit;.al  facility,  had  a  catwalk  that 
went  over  the  fence  from  a  public  road  to  the  building  housing  computer  con¬ 
trols  for  the  entire  Capline  system;  entry  to  the  building  was  uncontrolled 
during  the  day,  and  only  a  locked  door  protected  the  computer  itself.  Both 
Capline  and  Colonial  pumping  stations  have  even  been  burglarized  by  juveniles — 
who,  fortunately,  did  not  damage  or  misuse  the  equipment.  Access  to  many  key 
plants  was  uncontrolled  or  poorly  controlled.  Communications  and  backup  power 
were  poor:  a  major  Colonial  input  station  rated  at  1.3  Mb/d  peak,  for  example, 
had  both  its  main  and  backup  power  transformers  accessible  and  near  each  other 
[ id . : 29]  .  "Why  there  is  a  total  lack  of  security  around  such  [an  electrical] 
i nstal lat ion . . . i s  almost  beyond  comprehension."  [Stephens  1974:91]  Simply 
reducing  from  afar  the  line  voltage  supplied  to  a  facility's  motors  or  electro¬ 
nic  systems  can  cause  damage  that  takes  months  to  repair  [id.;  GAO  1979:23]. 

Many  supposedly  complementary  pipelines  parallel  each  other  so  closely 
that  in  practical  effect  they  are  colocated  and  co-vulnerable .  "Some  major 
crude  and  product  lines  are  extremely  close  to  each  other  as  they  extend  from 
Texas  and  Louisiana. . .northeast ... .Damage  at  certain  locat i ons .. .could  stop  the 
flow  of  most  of  the  gas  and  petroleum  products  now  being  delivered  to  the 
eastern  U.S."  [Stephens  1973: iv]  "The  fact  that  [the  Colonial  and  Plantation] 
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systems  come  together  at  a  number  of  points  in  their  [parallel]  route  is  a 
built-in  weakness  from  a  vulnerability  point  of  view.  A  nuclear  attack  focused 
at  or  near  certain  areas  of  interchange  between  lines  could  create  a  major  dis¬ 
ruption  of  the  major  portions  of  the  entire  system.  A  view  of  a  pipeline  map 
shows  flexibility  at  the  intrastate  level.  It  is  possible  for  one  pipeline 
system  to  sell  to  another  locally.  But,  once  the  product  is  discharged  into 
the  interstate  system,  there  is  a  considerable  lack  of  flexibility."  [id.:  58 ] 
Further,  the  buffer  stocks  of  oil  downstream  of  pipelines  are  generally  too 
small  to  cope  with  the  duration  of  interruption  that  would  be  expected  if  an 
interchange,  pumping  station,  input  terminal,  river  c-ossing,  or  control  system 
were  damaged  (that  is,  months  rather  than  days).  Average  refinery  crude  stocks 
are  about  3-5  days  [Stephens  1979:208].  Typical  Colonial  receivers'  market 
stocks  are  also  in  the  range  of  5-10  days  [id.),  and  a  two-week  interruption  of 
service  in  1973  when  difficulties  arose  in  repairing  a  break  in  a  remote  area 
of  Texas  "became  critical  for  many  Colonial  shippers"  [id.: 38 ]  . 

Sabotage  of  oil  pipelines  is  nothing  new.  The  first  screw-coupling  pipe¬ 
line  introduced  into  the  Pennsylvania  oilfields  in  1865  was  dismantled  at  night 
by  competitive  teamsters  [Congressional  Research  Service  1977:1:162).  In  re¬ 
cent  years,  as  pipeline  bombings  have  become  relatively  common  in  the  Mideast, 
they  have  started  to  occur  more  regularly  even  in  the  U.S.  A  Shell  gasoline 
pipeline  in  Oakland,  California  was  damaged  in  1969,  a  Puerto  Rican  pipeline  in 
1975,  and  TAPS  (as  mentioned  earlier)  in  1977  and  1978  [Energy  &  Defense  Pro¬ 
ject  1980:16).  A  compendium  of  bombing  incidents  [GAO  1978:11 :App. IX)  lists 
the  December  1974  dynamite  bombings  of  20  natural-gas  transmission  lines  (2"  to 
20")  and  two  natural-gas  cooling  towers  in  Kentucky;  the  September  1975  bomb¬ 
ing,  using  crude  high  explosives,  of  two  5000-barrel  oil  storage  tanks  in  Cali¬ 
fornia  (fortunately,  the  barrel  nearest  the  bomb  contained  only  water);  the 
discovery  of  a  live  military  mortar  round  at  an  oil  company  facility  in  New 
York  City  in  1977;  and  the  bombings  of  oil-company  buildings  in  Pittsburgh  in 
1974  and  in  San  Francisco  in  1975.  Should  social  tensions,  fanaticism,  or  sur¬ 
rogate  warfare  by  foreign  powers  again  focus  on  oil  pipeline  facilities,  wheth¬ 
er  through  the  violence  of  explosives  and  the  like  or  by  as  simple  a  means  as 
turning  valves  (most  of  which  are  readily  accessible  [Congressional  Research 
Service  1977:111:163)),  there  is  certainly  plenty  of  opportunity  to  expand  that 
list — which  is  itself  probably  far  from  complete. 

Natural  gas  (and  LPG)  pipelines  have  broadly  comparable  vulnerabilities, 

plus  the  disagreeable  feature  that  air  "makes  a  'bomb'  out  of  the  line  contain¬ 
ing  an  explosive  mixture"  [Stephens  1974:v).  Compressor  stations,  spaced  every 

40-200  miles  (65-325  km),  typically  use  gas  turbines — inefficient  but  rugged — 
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fueled  by  the  gas  itself,  an  improvement  over  oil  pipelines'  frequent  reliance 
on  electric  motors.  (The  compressor  stations  consume  some  3-5Z  of  the  gas 
carried:  pumping  for  oil  and  gas  pipelines  is  a  major  energy  user,  probably 
consuming  more  than  the  total  used  in  the  U.S.  by  either  water  heating  or  air¬ 
craft.)  Gas  compressor  stations,  like  their  oil  counterpart,  are  "virtually 
unguarded.  There  is  little  or  no  standby  equipment ... .The  system  can  be  easily 
damaged.  It  is  highly  vulnerable  to  almost  any  hazard  either  man  created  or 
natural.  Repair  to  a  damaged  segment  could  take  months."  [Stephens  1974: v] 
Most  lines  automatically  detect  breaks,  isolate  their  sections  (generally  shoi — 
ter  than  the  50-mile  average  interval  between  compressors,  as  there  are  also 
valves  at  each  junction  and  elsewhere),  and  turn  off  compressors  if  necessary. 
There  is  little  protection,  however,  for  the  control  and  communications  links 
tying  all  the  valves  and  compressors  to  a  computerized  central  dispatching 
system.  Stephens  [1973:34]  notes  that  because  of  the  total  reliance  on  remote 
telemetry  and  controls,  "cutting  of  wires  or  destroying  radio  [or  microwave] 
facilities  could  cause  considerable  confusion."  With  widespread  disruption  of 
communications  "the  system  could  become  completely  useless.”  Further,  "The 
operation  of  complex  pulse-time-modulation  multiplex  micro-wave  equipment, 
telemetering  equipment,  facsimile  units,  automatic  control  systems  and  voice 
communication  is  the  responsibility  of  the  communications  engineer.  In  a  large 
terminal  area,  the  engineer  might  have  an  assistant  or  two  but  as  a  general 
rule,  one  man  has  responsibility  for  the  equipment  over  a  very  large  area.,.. 
[I]t  is  doubtful  that  a  replacement  engineer  could  come  into  an  [extensively] 
damaged  complex  system  and  make  much  progress  in  its  early  repai r . . . .The  loss 
of  [key  personnel] .. .could  cause  very  significant  problems,  even  though  equip¬ 
ment  may  not  be  seriously  damaged.  Even  small  repairs  by  one  not  knowledgeable 
of  the  (particular]  system  can  become  a  major  problem."  [Stephens  1974:45] 

Gas  systems  have  a  further  point  of  vulnerability  with  no  strict  oil  ana¬ 
logue:  the  "city  gate"  station  where  incoming  pipeline  gas  is  metered,  odor- 
ized,  and  pressure-regulated.  This  last  function  is  crucial,  since  pipeline 
pressures  are  vastly  greater  than  retail  distribution  and  end-use  pressures. 
"Should  one  substantially  increase  pressure  on  the  [43  million  [Atallah  1980]] 
service  lines  serving  residences  and  public  buildings,  the  lines  and/or  appli¬ 
ances  could  rupture  and  the  escaping  gas  could  cause  fires  and  explosions.... 
Careful  pressure  regulation  is  required  in  order  for  gas  to  be  safe."  [Stephens 
1974:46]  Conversely,  pressure  reductions,  besides  putting  out  pilots  (p.  51), 
can  cause  damaging  frost  heaves  near  the  regulator  outlet  pipe  [Atallah  1980]. 

This  ability  to  wreak  widespread  havoc  by  remote  control  has  no  parallel 
downstream  of  oil  pipelines.  Although  the  thousands  of  primary  and  tens  of 
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thousands  of  secondary  oil  terminals  are  vulnerable  to  sabotage  [Stephens  1973: 
112],  and  local  oil  transportation  can  become  a  target — as  when  Japanese  oppos¬ 
ing  Narita  Airport  firebombed  a  train  carrying  jet  fuel  to  it  [Los  Angeles 
Times  1 98 Id ] — such  targets,  unlike  LNG  and  LPG  cargoes,  are  unlikely  to  cause 
more  than  locally  severe  damage  unless  they  endanger  some  larger  target,  such 
as  a  refinery,  tank  farm,  or  reactor,  near  the  site  of  attack.  Compared  to  the 
natural  gas  system,  with  its  virtually  complete  reliance  on  pipelines  and  its 
relatively  limited  storage,  even  the  vulnerable  oil  system — with  its  dispersed 
and  diverse  routes,  and  with  widespread  buffer  stocks  spotted  throughout  the 
local  distribution  system — seems  relatively  resistant  to  disruption  [Lerner  et 
al .  1967;  Grigsby  et  al .  1968;  Boesman  et  al .  1970]. 

Perhaps  compensating  for  the  extra  vulnerability  of  pressure  regulation, 
gas  grids  appear  to  offer  better  opportunities  than  oil  pipelines  for  rerout¬ 
ing.  The  Congressional  Research  Service  [1:16]  remarks  that  "In  the  last  ten 
years,  many  additional  interconnections  have  been  added,  to  the  point  that,  ac¬ 
cording  to  industry  sources,  there  is  hardly  a  crossing  between  two  pipelines 
without  an  interconnection  that  could  be  used  if  needed.  Compression  might  or 
might  not  be  needed  at  interconnecting  points  to  effect  deliveries  from  a  line 
operating  at  lower  pressure  than  the  receiving  line,  but  in  general,  the  tech¬ 
nical  problems  of  transferring  natural  gas  within  the  pipeline  network  are  re¬ 
portedly  not  overwhelming.  From  a  practical  standpoint,  the  United  States  has 
a  natural  gas  pipeline  'grid'  which  could  be  used  to  modify  the  directions  and 
quantities  of  natural  gas  flows  substantially."  How  far  this  would  remain  true 
if  key  interconnections  or  control  systems  were  disrupted  is  open  to  consider¬ 
able  doubt,  and  Stephens  [1979:213]  says  the  interstate  grid  is  fairly  inflex¬ 
ible  anyhow.  Nonetheless,  processed  natural  gas,  unlike  oil  (crude  or  specific 
products),  is  a  relatively  homogeneous  commodity  fungible  within  the  grid. 

A  recent  trend  accompanying  higher  oil  and  gas  prices  highlights  the 
vulnerability  of  their  grids:  the  prevalence  of  theft,  ranging  from  the  hijack¬ 
ing  of  a  25,000-gallon  tank  truck  to  the  theft  of  hundreds  of  thousands  of  gal¬ 
lons  from  Wyoming  fields.  "Oil  thefts  have  occurred  in  every  major  U.S.  port, 
notably  in  Houston  and  New  Orleans,  where  tankers  at  anchor  have  been  tapped. 
Gasoline  has  been  siphoned  out  of  storage  tanks  in  New  York,  Philadelphia  and 
Baltimore.  Barges  carrying  jet  fuel,  gasoline  and  heating  oil  on  the  Missis¬ 
sippi  River  have  been  robbed."  In  major  refineries  in  the  Southwest,  "there  is 
evidence  that  organized  crime  may  have  infiltrated"  and  the  FBI  has  assigned 
undercover  agents.  The  FBI  is  "spiking"  crude  oil  shipments  with  chemicals  so 
stolen  shipments  can  be  traced  [O'Toole  1981].  Further,  "The  technology  for 
tapping  into  a  pipdine,  even  a  high  pressure  natural  gas  pipeline,  without 
causing  a  leak,  explosion,  or  other  major  incident  revealing  the  existence  of 
the  tap,  is  published  and  well-known.  In  1975,  the  FPC  [Federal  Power  Commis- 
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sion]  reported  140  billion  cubic  feet  of  natural  gas  as  unaccounted  for,  about 
half  of  which  was  lost  during  transmission.  This  gas,  which  was  shown  on 
meters  entering  the  system,  but  was  neither  sold  to  customers,  placed  into 
storage,  or  used  in  compressors, ... (was  worth  at  1975  prices]  §110  million.  A 
portion  of  it  may  well  have  been  stolen."  (Congressional  Research  Service 
1977:111:165]  Clearly,  people  knowledgeable  enough  to  steal  large  amounts  of 
oil  and  gas  from  tankers,  pipelines,  tanks,  etc.  are  also  able  to  cause  serious 
harm  to  those  systems  if  they  are  so  minded. 

In  short,  by  increasing  its  reliance  on  a  highly  engineered,  inherently 
vulnerable  oil  and  gas  system  designed  for  a  world  of  infinite  tranquility,  the 
United  States  has  reached  the  point  where  a  handful  of  people  in  a  single  night 
could  stop  over  75%  of  gas  supplies  to  the  Eastern  U.S.  for  a  year  (Kupperman  & 
Trent  1979:73]  without  ever  leaving  Louisiana.  With  a  little  more  travelling, 
they  could  cause  lasting  havoc  in  the  oil  system  too.  This  is  a  function  not 
only  of  where  the  oil  and  gas  come  from — nearly  three-fourths  of  total  marketed 
U.S.  gas  extraction,  for  example,  is  in  Texas  and  Louisiana — but  also  of  the 
nature  of  the  processing  and  distribution  technologies,  which  is  an  expression 
of  the  nature  of  the  fuels  themselves. 

It  is  encouraging  that  many  new  oil  and  gas  discoveries  are  highly  dis¬ 
persed,  especially  in  traditional  importing  areas  (e.g.  Byron  1981;  Pennino 
1981],  and  that  this  might  reduce  dependence  on  long-distance  pipelines — a  goal 
Stephens  recalls  was  once  met  with  dispersed  town-gas  plants  [1974:80].  But  at 
the  same  time,  the  proposed  massive  program  of  synthetic-fuels  development, 
chiefly  from  Western  coal  and  shale,  would  add  profound  new  vulnerabilities,  as 
the  processes  not  only  must  deliver  their  products  by  long  pipelines,  but  also 
depend  on  enormous  deliveries  of  water,  power,  and  feedstock,  often  from  far 
away.  Supplying  10%  of  present  U.S.  oil  use  would  take  90  $2-billion  plants, 
using  half  of  all  U.S.  coal  mined  in  1978  (Taylor  1980:309],  In  1944,  Allied 
bombing  around  the  Ruhr  reduced  German  synfuel  output  by  more  than  90%  (from 
nearly  100,000  b/d)  in  a  few  months,  hobbling  the  Nazi  war  machine  [Energy  & 
Defense  Project  1980:22-24].  (Earlier,  a  single  raid  on  1  August  1943  had 
destroyed  350,000  barrels  of  oil  and  half  the  refining  capacity  in  the  Romanian 
oilfields  at  Ploesti,  then  a  key  German  source.)  It  now  appears,  as  noted 
above  (p.  49),  that  earlier  bombing  of  other  German  oil  facilities,  especially 
those  making  aviation  fuel,  would  have  curtailed  World  War  II  still  sooner 
[SIPRI  1974:142-145].  In  our  own  day  we  see  fire  and  bomb  attacks  on  South 
Africa's  crucial  SASOL  synfuel  facilities  [Burns  1980].  These  historical 
lessons  do  not  bode  well  for  the  present  or  future  dependence — either  of 
America's  0.7  Mb/d  military  machine  [Maize  1980]  or  of  our  civilian  economy — on 
any  centralized  source  of  liquid  fuels,  natural  or  synthetic. 
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3.3.  Central-electric  systems. 

The  vulnerability  of  oil  and  gas  terminals,  processing  plants,  and  pipe¬ 
lines  is  mirrored  in  central-electric  systems — only  worse.  Electricity,  though 
not  itself  flammable  or  explosive,  is  very  difficult  and  costly  to  store  in 
bulk.  While  the  oil  and  gas  systems  contain  at  several  stages  extensive  stor¬ 
age  providing  a  "pipeline  inventory"  of  weeks  or  months,  the  electric  grid  has 
no  significant  storage  between  plant  and  end-users  (unless  they  have  provided 
local  storage  or  backup  at  their  own  substantial  expense).  Thus,  in  the  event 
of  supply  or  delivery  failures,  unless  electric  power  can  be  rapidly  rerouted — 
subject  to  the  availability  of  generating  and  transmission  capacity,  of  switch- 
gear,  and  of  control  and  communications  capability — disruption  is  instantaneous 
and  can  be  widespread.  Further  complications — the  great  complexity  of  maintain¬ 
ing  synchronization,  frequency  and  phase  stability,  and  voltage  stability,  and 
the  tendency  of  these  requirements  to  complicate  restoration  after  failure — were 
already  surveyed  in  Chapter  2,  and  are  markedly  less  tractable  than  the  analo¬ 
gous  problems  of  maintaining  oil  and  gas  purity  and  distribution  pressure.  The 
time  constants  of  the  electric  system  are  also  far  shorter:  control  response  is 
often  required  in  milliseconds,  not  minutes  or  hours.  Reliance  on  computeriza¬ 
tion,  farflung  telecommunications  networks,  and  specialized  skills — already 
cause  for  concern  in  oil  and  gas  grids — is  even  greater  in  electric  grids. 

There  are  also  close  analogies  in  vulnerability.  Chapter  2  noted  that  many 
key  components  of  electrical  systems,  ranging  from  turboalternators  to  main 
transformers,  are  special-order  items  with  long  delivery  times.  Repair  of  sub¬ 
stations  and  transmission  lines  has  many  features  in  common  with  repair  of  pipe¬ 
lines  and  pumping  stations.  Just  as  refineries  depend  on  continuous  supplies  of 
cooling  water,  pump  lubricants,  etc.,  so  do  many  costly  electrical  components. 
The  analogies  continue  even  to  certain  details:  just  as  refineries,  for  example, 
have  a  risk  of  explosion  from  hydrogen  used  to  hydrogenate  carbon-rich  molecules 
into  light  products,  so  big  electrical  generators  too  are  often  cooled  with  hy¬ 
drogen  (whose  small  molecules  reduce  friction).  But  perhaps  because  power  fail¬ 
ures  are  so  much  more  immediate  and  dramatic  than  interruptions  of  oil  or  gas 
supply,  and  offer  so  few  options  of  substitution  in  the  highly  specialized  end- 
use  devices,  electrical  grids  and  their  components  seem  to  be  far  more  frequent¬ 
ly  sabotaged  than  oil  and  gas  grids.  This  section,  building  on  the  introductory 
material  in  Chapter  2,  will  further  examine  the  particular  vulnerabilities  which 
led  the  Comptroller-General  [ 1 98 la]  to  find  that  sabotage  of  eight  substations 
could  black  out  a  typical  region,  and  that  sabotage  of  only  four  could  leave  a 
city  in  that  region  with  no  power  for  days  and  rotating  blackouts  for  a  year. 
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3.3.1.  Power  stations. 

About  12%  of  the  domestically  generated  electricity  supplied  to  U.S.  grids 
comes  from  about  1200  hydroelectric  dams,  of  which  about  360  exceed  25  MWe. 

Most  of  the  output  currently  comes  from  a  small  number  of  very  large  dams, 
although  (as  Chapter  7.3.2  will  note)  this  is  likely  to  change  in  the  next  few 
decades.  Most  dams  and  their  turbines  (though  not  their  switchgear  and  trans¬ 
mission  lines)  are  relatively  resistant  to  interference — luckily,  since  de¬ 
struction  of  a  dam  often  carries  a  risk  of  serious  flooding.  About  IX  of  na¬ 
tional  installed  generating  capacity  is  in  nearly  a  thousand  diesel  engines, 
mainly  in  rural  areas  and  small  peaking  plants.  Another  8%  of  the  capacity  is 
in  about  1200  gas  turbines,  run  on  average  only  7X  of  the  time;  their  high  fuel 

cost  and  low  thermal  efficiency  restricts  them  to  peaking  use.  About  0.1%  is 

in  geothermal  and  wind  capacity.  The  remaining  plants — about  78%  of  installed 
capacity,  supplying  about  82%  of  the  kilowatt-hours — are  the  900-odd  major 
"thermal"  (steam-raising)  plants,  operating  on  average  at  just  under  half  their 
full-time,  full-power  capacity,  and  generating  in  1979  about  55%  of  their  out¬ 
put  from  coal,  15%  from  oil,  17%  from  natural  gas,  and  13%  from  uranium.  (Since 
then  the  oil  burn  has  fallen  dramatically,  from  about  1.7  Mb/d  nearly  to  1  Mb/d 

in  1981,  heading  for  0.8  Mb/d  or  so  by  the  end  of  1982  [Taylor  1980a].  The  main 

substitutes  for  oil  have  been  coal  and  efficiency  improvements.)  These  statis¬ 
tics  do  not  include  self-generation  of  electricity  in  factories.  This  "cogen¬ 
eration"  as  a  byproduct  of  process  heat  or  steam,  using  combined-cycle  steam 
turbines,  diesels,  or  gas  turbines,  probably  provides  electricity  equivalent  to 
at  least  5%  of  the  electricity  generated  for  the  grid,  and  is  often  independent 
of  grid  operation,  providing  its  proprietors  with  greater  "insurance"  (p.  52). 

The  large  thermal  plants  supplying  over  four-fifths  of  U.S.  grid  electri¬ 
city  deserve  special  attention  here,  not  only  because  of  their  centralization 
and  dominance,  but  also  because  they  need  continuous  provision  of  fuel,  cool¬ 
ing  water,  outlets  for  their  electricity  and  effluents,  and  control  and  commun¬ 
ications  systems.  Interruption  of  any  one  of  these  will  shut  down  the  plant. 
(On-site  fuel  stocks,  however,  can  provide  a  buffer  of  days  to  weeks  for  dual¬ 
fuel  gas-fired  plants  holding  oil  stockpiles,  one  or  two  months  for  oil-fired 
plants,  three  months  or  more  for  coal,  and  one  or  more  years  for  nuclear. 
Single-fuelled  gas-fired  plants,  common  in  such  regions  as  Texas  [whose  grid  is 
not  interconnected  with  the  rest  of  the  country],  carry  almost  no  stocks:  Goen 
er  al .  (1970:75)  found  that  San  Francisco's  entire  gas  storage  capacity  would 
last  one  local  gas-fired  power  plant  for  only  14  hours.)  Power  plants'  complex, 
special-purpose  machinery  itself  is  of  course  also  vulnerable  to  disruption, 
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even  by  low-technology  means:  modern  turboalternators,  for  example,  are  so  big, 
yet  so  delicate,  that  when  not  spinning  they  must  have  their  shafts  rotated  a 
fraction  of  a  turn  several  times  per  hour,  by  hand  if  necessary,  lest  their  own 
weight  ruin  them  by  bending  the  shaft  out  of  true.  On  occasion,  such  as  during 
the  Three  Mile  Island  accident,  this  service  has  been  difficult  to  provide  in 
the  face  of  evacuation  requirements. 

The  vulnerability  of  central  thermal  power  stations  is  not  a  new  issue. 

In  1966,  the  Defense  Electric  Power  Administration  [ 1 966 : 1 3A ]  pointed  out  that 
"fewer  than  200  cities  and  towns  of  over  50,000  population  contain  about  60%  of 
the  population  and  associated  industrial  capacity  of  the  nation.  The  larger 
generating  facilities  tend  to  be  located  nearfby] . . . .Generat ing  capacity  is  the 
most  difficult,  costly,  and  time  consuming  component  of  an  electric  power 
system  to  replace  and  also  tends  to  be  highly  concentrated  geograph i cal ly .  If 
any  portion  of  the  power  system  is  to  be  considered  a  primary  [strategic] 
target,  it  would  be  these  large  generating  plants.... Is  the  concentrat ion  of 
power  generation  making  the  industry  more  vulnerable....?" 

In  the  intervening  15  years,  the  question  has  been  often  repeated,  yet  the 
concentration  has  increased,  with  major  power  plants  being  drawn  to  conurba¬ 
tions  and  probably  encouraging  urban i zat i on  and  industrial  concentration  in 
their  turn.  "Although  there  are  about  3,500  companies  involved  in  generating 
and  distributing  electricity,  about  half  of  our  total  electrical  capacity  comes 
from  fewer  than  300  generating  stations.  Most  of  these  are  located  in  or  near 
our  major  urban-industrial  areas.  The  electric  utilities  therefore  present  a 
relatively  compact  and  especially  inviting  set  of  targets  for  a  saboteur,  a 
terrorist  or  an  attacker,  as  well  as  a  lightning  bolt."  [Joint  Committee  on 
Defense  Production  1977a: 1 ]  Though  this  concentration  is  less  than  that  of 
some  other  sectors — pipelines,  large  refineries,  smelters,  etc.  [Goen  et  a 1 . 
1970:71]  —  it  is  also  uniquely  true  of  power  stations  that  the  loss  of  substan¬ 
tial  generation  or  transmission  capacity  can  crash  the  whole  grid,  shutting 
down  undamaged  plants  that  are  inadequate  to  maintain  system  frequency.  The 
Research  Director  of  the  American  Public  Power  Association  was  recently  moved 
by  these  trends  to  remark  [Holmberg  1981]  that  "there  is  considerable  evidence 
that  one  of  our  highest  national  defense  priorities  should  be  to  insure  the 
continuity  and  productivity  of  the  United  States  through  aggressive  support  of 
decentralized  energy  supply."  Confirming  this,  attacks  on  power  stations  have 
become  almost  a  routine  feature  of  guerrilla  campaigns,  ranging  from  Italy  and 
Puerto  Rico  (as  noted  in  Chapter  2.2.2)  to  Cyprus  (1955),  Britain  (1969,  by 
internal  sabotage  at  Aberthaw  and  perhaps  Fiddler's  Ferry),  Eire  (1974),  Chile, 
and  El  Salvador.  After  a  California  plant  bombing,  one  power  engineer  told  us 


that  the  company  had  escaped  with  minor  damage  only  by  the  saboteurs'  lucky 
choice  of  the  strongest  point  on  the  strongest  station:  electric  plants,  he 
said,  are  "terribly  vulnerable.  Someone  who  knew  anything  at  all  could  cause 
terrible  havoc."  Other  targets  could  easily  have  been  "blown  over." 

3.3.2.  Electrical  transmission. 

High-voltage  transmission  lines  carry  an  astonishing  amount  of  energy, 
second  only  to  large  pipelines.  A  500-kV  line  typically  handles  about  2  GWe, 
the  output  of  two  giant  power  stations  (Congressional  Research  Service  1977:1: 
357);  a  765-kV  line,  about  3  GWe.  In  some  areas,  such  as  New  York  City  and 
South  Florida  [Joint  Committee  on  Defense  Production  1977a: 7—8-]  ,  geography 
squeezes  supposedly  independent  transmission  lines  into  a  single  narrow  corri¬ 
dor.  In  others,  remotely  sited  plants,  perhaps  at  a  Western  coal-mine,  send 
their  lines  over  hundreds  of  miles  of  remote  countryside.  No  transmission  line 
can  function  without  switchgear  and  controls  at  each  end:  the  entire  New  York- 
New  England  power  pool,  for  example,  is  controlled  from  a  single  center  near 
Schenectady  [Joint  Committee  on  Defense  Production  1977:11:36).  Broadly  speak¬ 
ing,  the  contiguous  U.S.  grid  is  interconnected  within  each  of  three  largely 
separate  regions  [Congressional  Research  Service  1977:1:365] — Texas,  eastern, 
and  western,  with  the  demarcation  running  roughly  through  Nebraska — but  inter¬ 
change  between  the  constituent  pools  of  each  region  is  heavily  dependent*  on 
particular  transmission  segments,  such  as  the  7-GWe  Wisconsin-Missouri-Illlnpls 
intertie  [Metz  1977],  as  well  as  on  the  pool  and  utility  control  centers  and 
communicat ion  systems  and  on  uniquely  vulnerable  extra-high-voltage  switchgear 
and  transformers  [Kupperman  &  Trent  71-72,106].  Despite  their  key  role  in 
interstate  commerce,  transmission  lines  are  in  general  not  protected  by  Federal 
law  (Joint  Committee  on  Defense  Production  1977a:8]  . 

Transmission  lines  have  often  been  sabotaged.  Examples  cited  by  the  Energy 
&  Defense  Project  [1980:16]  include  New  Jersey  1978,  Colorado  (lines  feeding  a 
military  plant)  1969,  and  California  1975.  Fourteen  towers  in  Oregon  were 
bombed,  and  at  least  six  toppled,  in  1974  by  an  extortionist  threatening  a 
Portland  "blackout";  pipe  bombs  caused  minor  damage  at  six  California  towers 
in  one  night  in  1975  [GAO  1978:Il:App.  IX].  Other  attacks  include  Alabama 
1966,  Ohio  (blacking  out  parts  of  Cincinnati)  and  Louisiana  1967,  Wisconsin 
1968,  and  California  and  Washington  1973  [Flood,  personal  communication].  In 
the  bitter  confrontation  mentioned  in  Chapter  2.1.3,  conservative,  fiercely 
independent  Minnesota  farmers  during  1979-80  caused  $7  million  in  damage  to  an 
800-kVDC  line.  No  -al  "  -it  weevils,"  having  perfected  a  low-technology 

*For  examples,  see  [Economic  Regulatory  Administration  1979:11:181-216]. 
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technique  requiring  only  a  few  people  and  hand  tools,  have  toppled  14  towers, 
and  an  outbreak  of  "insulator  disease,"  commonly  ascribed  to  rifles  (or  even  to 
sophisticated  slingshots),  has  littered  the  ground  with  the  remains  of  over 
8,000  fragile  glass  insulators.  The  epidemic  attacked  350  insulators  per  week 
in  early  1979 — sometimes  more  than  that  in  a  single  night  [Casper  &  Wellstone 
1981:283,285].  The  1.5"  aluminum  wires  themselves  proved  vulnerable  to  rifle 
fire  [J_d.:277].  Guarding  just  the  Minnesota  section  of  line — 176  miles  with 
685  towers,  often  through  farmers'  fields  far  from  public  roads — is  still,  at 
this  writing,  proving  an  impossible  task.  Despite  high-speed  helicopters,  a 
$100,000  reward,  300  private  guards,  and  extensive  FBI  activity,  not  one  of  the 
perpetators  has  been  caught.  It  is  no  more  likely  that  they  will  be,  given  the 
depth  of  their  local  support,  than  that  South  Africa  will  discover  who  has,  as 
we  write  this,  cut  its  power  lines  from  the  Cabora  Bassa  dam  in  Mozambique, 
threatening  South  Africa  with  "selective  power  cuts"  [Los  Angeles  Times  1981e]  , 
and  blacked  out  Durban  by  blowing  up  a  substation  [id.:1981g].  No  wonder  an 
Interior  Department  expert  confirmed  that  "a  relatively  small  group  of  dedicat¬ 
ed,  knowledgeable  individuals .. .could  bring  down  [the  power  grid  supplying] 
almost  any  section  of  the  country,"  or  "a  widespread  network"  if  organized  on  a 
somewhat  broader  scale  [Joint  Committee  on  Defense  Production  1977a:87], 

Even  without  interference,  transmission  lines  are  vulnerable  enough.  Of 
the  twelve  worst  interruptions  in  U.S.  bulk  power  supply  during  1974-79,  six 
were  caused  by  failures  in  transmission,  six  in  distribution,  and  none  in  gen¬ 
eration.  Seven  were  initiated  by  bad  weather,  four  by  component  failures,  and 
one  by  operator  error.  [Economic  Regulatory  Administration  1981:4-4]  Among  all 
reported  interruptions  during  1970-79,  however,  "75%  have  been  due  to  problems 
related  to  facilities,  maintenance,  or  operation  and  coordination.  Only  25% 
have  been  initiated  by  weather  or  other  forces  external  to  the  utility"  [ id . : 
4-5].  Whatever  the  causes,  failures  are  rife.  On  5  April  1979,  a  buildup  of 
dust  and  salt  spray  on  240-kV  insulators  caused  arc-over,  leaving  no  outlet  for 
three  generating  stations  and  blacking  out  the  Miami  area  and  much  of  Fort 
Lauderdale  and  West  Palm  Beach  [International  Herald  Tribune  1979]  .  The  Quebec 
transmission  grid  averages  about  three  major  failures  per  year,  chiefly  in  cold 
spells  which  (owing  to  the  intensive  promotion  of  electric  heating)  coincide 
with  peak  demand.  In  the  chilly  first  week  of  January  1981,  both  Hydro-Quebec 
and  Ontario  Hydro  met  record  peak  loads  only  by  importing  power:  the  former 
had  lost  nearly  2  GWe  through  transformer  failure  at  the  James  Bay  hydro  site, 
and  the  latter,  about  1.5  GWe  through  emergency  shutdowns  at  two  nuclear  plants 
and  a  coal  plant  [Claridge  1981].  On  8  January  1981,  a  sudden  power  failure, 
apparently  due  to  a  quadruple  transmission  failure,  blacked  out  all  of  Utah  and 


parts  of  Idaho  and  Wyoming  for  3-6.5  hours— some  1.5  mi  11  ion  people  in  all  [New 
York  Times  1981],  On  24  September  1980,  most  of  Montana  was  blacked  out  for 
about  an  hour,  prompting  editorial  comment  on  the  vulnerability  of  "Society's 
electric  heartbeat"  [Great  Falls  Tribune  1980].  Both  these  regions  are  of 
special  interest  because  they  are  officially  planned  to  become — via  coal  mines, 
coal  slurry  pipelines,  and  synfuel  plants,  all  of  which  are  extremely  dependent 
on  reliable  electric  supplies — a  main  source  of  domestic  fuel  to  replace 
Mideast  oil.  In  various  parts  of  the  country,  transmission  lines  have  been 
interrupted  by  aircraft  accidents  (a  National  Guard  helicopter  crashing  into  a 
161-kV  TVA  line  in  1976),  explosions,  equipment  faults,  broken  shield  wires 
(which  run  from  the  apex  of  one  tower  to  the  next),  and  even  kite  flying  [Clapp 
1978:41].  Southern  California  Edison  Company  has  experienced  extensive  damage 
to  16-kV  and  smaller  wooden-poled  lines  (though  little  to  >22-kV  lines  on 
steel  towers)  through  forest  fires;  and  on  occasion,  the  fiery  heat  has  ionized 
the  air  sufficiently  to  short  out  conductors  [Chenoweth  etal.  1963:34). 

3.3.3.  Substations  and  distribution  networks. 

Transmission  is  usually  considered  to  involve  lines  carrying  at  least 
69,000  volts  (69  kV),  and  bulk  power  transmision,  over  230  kV  [Congressional 
Research  Service  1977:1:349],  "Main  transmission  lines  are  extremely  difficult 
to  protect  against  sabotage  as  they  are  widespread  over  each  state  and  traverse 
remote  rugged  and  unsettled  areas  for  thousands  of  miles.  While  these  facili¬ 
ties  are  periodically  patrolled,  ample  time  is  available  for  a  saboteur  to  work 
unobserved.  It  may  be  comparatively  easy  to  damage  this  part  of  a  system,  but 
it  is  readily  repaired.  Damage  to  remote  controlled  or  automatic  substation 
equipment  could  make  repairs  and  operation  more  difficult."  [Defense  Electric 
Power  Administration  1962:25-26]  The  analogy  with  pipelines  is  clear  enough: 
the  line,  save  in  especially  awkward  locations,  is  far  quicker  to  repair  than 
its  interchanges  and  operational  systems  (pumping  stations  for  pipelines,  sub¬ 
stations  for  electric  transmission).  A  principal  point  of  vulnerability, 
albeit  one  seldom  capable  of  blacking  out  more  than  a  relatively  local  area, 
is  the  substation  which  transforms  transmission  to  lower  voltages  for  distri¬ 
bution  over  subtransmission  lines  and  over  4  million  pole-miles  of  retail 
distribution  lines  [Defense  Electric  Power  Administration  1969].  Although  DEPA 
[1962:26]  considers  that  damage  to  substations  and  distribution  networks  "would 
have  such  a  slight  effect  on  the  overall  system  as  to  make  this  type  of 
sabotage  unlikely",  many  saboteurs  evidently  do  not  see  it  that  way.  There  are 
over  four  times  as  many  substations  rated  over  10  MVA  as  there  are  central 
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power  stations  [Goen  et  al .  1970:79],  so  near  virtually  any  load  center  there 
is  a  corresponding  substation — an  effective  target  for  highly  selective  black¬ 
outs  or  a  convenient  one  for  synbolic  damage.  Both  transmission  substations 
(serving  mainly  large  industrial  customers  at  subtransmission  voltages)  and 
distribution  substations  (serving  mainly  residential  and  commercial  customers) 
have  been  attacked  by  many  means.  In  1975  and  1977,  the  same  Pacific  Gas  & 
Electric  Co.  substation  was  damaged  by  pipe  bonbs,  interrupting  tens  of  thous¬ 
ands  of  customers  [Joint  Committee  on  Defense  Production  1977a:61].  Four  other 
PG&E  substation  bonbings  caused  local  blackouts  in  1977,  and  a  transformer  boob 
ing  blacked  out  eastern  Puerto  Rico  in  1975  [Energy  &  Defense  Project  1980:16]. 
Additional  substation  and  transformer  bonbings  occurred  in  California  and  Seat¬ 
tle  1975,  Colorado  (causing  $250,000  damage)  in  1974,  Albuquerque  in  1977,  and 
two  California  sites  in  1977  [GAO  1978 : II : App. IX] .  During  1974-77,  the  FBI  re¬ 
ported  a  total  of  10,919  actual  or  attempted  bonbings  in  the  U.S.,  of  which  82% 
(5273  explosive  and  3686  incendiary)  were  successful.  Although  public  utilities 
represented  only  1.9%  of  the  total  targets  in  1975-76,  they  did  suffer  53  delib¬ 
erate  explosions  in  that  period — about  one  every  two  weeks  [uK  ]  .  In  some  in¬ 
stances,  such  as  the  Oregon  transmission-line  bonbings  in  1974,  the  campaign  was 
so  concerted  that  a  massive  investigation  and  manhunt  were  deemed  necessary 
[Congressional  Research  Service  1977:111:159].  To  con^>licate  matters,  utility 
transformers  often  contain  cooling  oil  that  can  be  released  and  ignited  by 
standoff  methods,  including  rifle  fire;  the  oil  may  contain  highly  toxic  PCBs, 
which  greatly  conpLicate  repairs;  and  hard-to-trace  disruption  can  be  caused 
singly  by  using  the  substation's  controls  without  damaging  them.  (A  novel 
[Chastain  1979]  describes  a  fictional  extortionist  who  caused  blackouts  in  New 
York  City  by  throwing  under-street  transformer  switches.)  Con  Ed's  Indian  Point 
sibstation  even  caused  a  blackout  19  July  1977  when  it  blew  up  all  by  itself;  a 
similar  incident  on  12  July  1981 — one  of  three  Con  Ed  substation  fires  in  five 
days — blacked  out  39,000  customers  [Gargan  1981].  A  recent  failure  at  a  single 
69-kV  transformer  blew  it  up,  ignited  3000  gallons  of  cooling  oil,  and  halted 
the  supply  via  13  underground  cables  to  two  substations,  blacking  out  for  four 
hours  6%  of  Con  Ed's  load — much  of  lower  Manhattan,  including  one  of  the 
world's  densest  concentrations  of  financial  conqjuters  [Kihss  1981,1981a]. 

To  the  end-user,  it  matters  little  whether  a  power  interruption  is  in  the 
bulk  supply — which  accounts  for  only  about  15%  of  the  total — or  in  distribution 
(the  other  85%)  [Economic  Regulatory  Administration  1981:4-10].  The  roughly 
365,000  circuit  miles  of  overhead  transmission  [^d.:2-9]  and  its  switchgear  and 
control  systems  are  a  testing  target  for  widespread  disruption;  but  for  local 
or  selective  disruption,  sabotage  of  distribution  is  at  least  as  easy  to  arrange 
and  at  least  as  hard  to  repair,  with  the  added  bonus  that  alternative  distribu¬ 
tion  (unlike  transmission)  routes  are  often  not  available  unless  the  utility 
happens  to  have  suitable  mobile  equipment  that  can  be  spliced  in  temporarily. 
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3.3.4.  Control  and  communications. 

No  part  of  the  synchronous  electric  grid  can  function  without  continuous 
comminicat ions  from  such  centralized,  computerized  control  points  as  utility  and 
pool  dispatchers  to  each  other  and  to  the  field.  The  vulnerability  of  field 
hardware  to  nuclear  attack  [Chenoweth  et  al .  1963;  Lanbert  1976]  pales  beside 
control  vulnerability  to  the  10-nsec-r iset ime  electromagnetic  pulse  (EMP) — 
peaking  at  50  kV/m  and  6  MW/m^  (6000x  the  power  density  of  peak  sunlight) 

produced  by  a  1-MT  high-altitude  thermonuclear  burst  over  a  radius  of  800  km 
or  more  [Lerner  1981:42].  Thus  one  blast  high  over  the  central  U . S .  would 
blanket  all  lower  48  States  with  a  pulse  of  at  least  25  kV/m  [King  et  al  .  1980] 
— ample  to  cause  an  instantaneous  common-mode  failure  of  unhardened  electrical 
and  electronic  systems,  including  electric-grid  and  pipeline  controls,  tele¬ 
phones,  and  other  telecommunicat ions  except  fiber  optics.  Host  grid  controls 
would  be  damaged  functionally  (burned-out  transistors)  or  operationally  (erased 
computer  memory)  [Lanbert  1976:51;  Lerner  1981:42ff]:  integrated  circuits  are 
about  ten  million  times  as  prone  to  EMP  burnout  as  vacuum  tubes  [Broad  1981]. 
Since  power  lines  act  as  antennas  to  collect  the  pulse,  and  its  risetime — a 
hundred  times  faster  than  lightning — is  too  fast  to  be  stopped  by  most  lightning 
arrestors,  many  end-use  devices  would  probably  be  burned  out.  Such  non-control 
devices  as  transformer  windings  and  transmission-line  insulation  could  also  be 
damaged  by  peak  induced  surges  as  high  as  30  GW  [Lerner  1981:42ff].  Nuclear 
reactor  safety  systems  may  be  disabled  [Energy  &  Defense  Project  1980:305],  per¬ 
haps  causing  an  epidemic  of  meltdowns  [Lerner  1981a].  Design  trends  in  the 
power  industry  are  tending  to  increase  the  likelihood  of  EMP  damage  [Nelson 
1971],  and  "the  extreme  difficulty  and  expense  of  protecting  the  grids  has 
discouraged  utilities  from  taking  virtually  any  action"  [Lerner  1981:46], 

The  power  grid's  control  and  communication  are  vulnerable  to  commoner  haz¬ 
ards  than  EM*.  "Because  of  their  vital  role  in  system  reliability,  the  computer 
facilities  in  control  centers  are  usually  doubly  redundant  (backed  up  by  a  com¬ 
plete  set  of  duplicate  facilities);  in  at  least  one  center  they  are  triply  re¬ 
dundant.  Their  power  supplies  are  ' uninterruptab le'  and  are  also  often  doubly 
redundant."  [Econ.  Regul .  Admin.  1981:2-8].  Yet  a  pocket  magnet,  as  Stephens 
points  out,  can  give  a  computer  amnesia.  Grids*  ability  to  reroute  power  [Lam¬ 
bert  &  Minor  1975]  assumes  the  perfect  operability  of  control  systems.  Control 
centers,  furthermore,  must  communicate  with  each  other  and  with  field  equipment 
(generators,  switches,  relays,  etc.);  otherwise  no  rerouting  or  load  alterations 
are  possible.  This  communication  relies  on  telex,  telephone,  signals  sent  over 
the  power  lines  themselves,  radio,  and  private  microwave  circuits.  Despite 
battery  and  standby-generator  power  supplies,  all  these  links  are  vulnerable  to 
disruption.  With  microwaves,  for  example,  "the  loss  of  one  base  or  repeating 
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station  can  easily  make  a  large  portion  of  the  communication  system  inoperable" 
[Defense  Electric  Power  Administration  1962:31).  Most  utility  operations  can 
probably  be  disrupted  far  more  easily  by  attacks  on  their  communication  systems 
than  on  generation,  transmission,  or  distribution  components.  Without  instant 
communication,  or  at  least  an  army  of  experts  in  the  field  manually  operating 
the  system  according  to  prompt  radio  ir struct  ions,  the  stability  of  the  grid 
will  be  in  danger.  Few  utilities  have  installed  reliable  under frequency  relays 
to  ensure  that  if  control  and  synchronici ty  are  lost,  their  grid  will  automati¬ 
cally  isolate  itself  into  small  islands,  maintaining  service  where  possible  and 
at  least  preventing  serious  damage  to  major  components. 

Another  disturbing  possibility,  to  which  no  attention  appears  to  have  been 
given,  is  that  rather  than  merely  cutting  communications,  a  saboteur  might — 
like  a  phone  phreak — prefer  to  use  them.  Indeed,  both  private  and  public  tele¬ 
phone  lines  can  be  tapped  into  remotely,  as  noted  in  Chapter  1.2.4,  and  many 
utilities'  control  computers — not  merely  their  accounting  computers — appear  to 
be  accessible  to  phone  phreaks.  Such  codes  as  are  normally  used  are  easily 
broken  by  the  phreaks'  microcomputers.  Worse  still,  despite  the  encryption 
used  on  some  utility  microwave  networks,  it  is  probably  well  within  many  elec¬ 
tronic  enthusiasts’  capabilities  to  tap  into  a  utility  microwave  net  using  a 
portable  dish  and  effectively  to  take  over  the  grid. 

One  utility  control  expert  with  whom  we  discussed  these  concepts  felt  that 
the  diversity  of  communi ct i ons  links  which  his  company  uses,  and  certain  tech¬ 
nical  features  of  its  microwave  and  other  systems,  would  make  takeover  diffi¬ 
cult:  most  likely  the  company's  operators  could  still  maintain  control.  But  he 
agreed  that  this  result,  if  true,  was  not  by  design  but  by  accident — a  result 
of  precautions  taken  against  natural  disastei — and  that  companies  less  sophis¬ 
ticated  than  his  own  (perhaps  the  best-prepared  in  the  country  in  this  regard) 
might  well  be  worse  off.  That  particular  grid  is  designed  to  be  manually 
operable  from  dispersed  control  centers,  but  it  is  not  hard  to  envisage  ways  in 
which  communications  between  them  could  be  blocked  or  spoofed,  and  the  grid 
perturbed,  in  ways  beyond  the  ability  of  manual  control  to  handle.  For  most  if 
not  all  electric  utilities,  elementary  consideration  of  the  published  details 
of  communication  systems  suggest  that  the  vulnerabilities  commonly  discussed — 
such  as  the  risk  of  sabotage  to  switchyards,  transmission  lines,  and  power 
plants — are  just  the  tip  of  the  iceberg.  Analogous  considerations  apply  to  the 
control  and  communications  systems  of  oil  and  gas  pipelines. 

In  summary,  whether  by  brute-force  sabotage  of  a  key  switching  or  trans¬ 
mission  facility  or  of  one  of  the  operational  lifelines  (such  as  cooling  water 
or  fuel  transportation)  of  one  or  more  giant  power  plants,  or  instead  by  an 


98 


elegantly  economical  disruption  of  control  and  communications  systems,  a  small 
group  of  people — perhaps  one  able  person  in  some  ci rcumstances — could  black  out 
practically  any  city  or  region.  With  careful  selection  of  targets  and  of  their 
most  vulnerable  times  (peak  loads,  options  limited  by  preexisting  outages, 
unfavorable  weather  for  repair,  etc.),  it  should  not  be  beyond  the  ability  of 
some  technically  astute  groups  to  black  out  most  or  all  of  any  of  America's 
three  synchronous  grid  regions.  These  blackouts  can  be  engineered  in  such  a 
way  as  to  cause  substantial  damage  to  major  items  of  equipment,  probably  re¬ 
quiring  months  or  years  to  repair.  It  is  conceivable  that  similar  breakdowns 
could  arise  from  a  combination  of  natural  disasters,  imperfect  utility  re¬ 
sponse,  and  incomplete  understanding  of  the  operational  dynamics  of  big  grids. 
However  caused,  a  massive  power-grid  failure  would  be  slow  and  difficult  to 
restore,  would  gravely  endanger  national  security,  and  would  leave  lasting 
economic  and  political  scars. 


3.4.  Nuclear  fission  systems. 


Nuclear  power  reactors*  suffer  from  the  vulnerabilities  already  described 
for  central-electric  systems.  This  section  explores  the  following  additional, 
uniquely  nuclear  vulnerabilities  of  reactors  and  their  ancillary  plants: 

-  their  enormous  radioactive  inventories,  which  may  be  a  focus  for  civil 
concern  and  unrest  [Ramberg  1978J  ,  an  instrument  of  coercion  [Norton 
1979],  and  a  cause  of  devastation  if  released  by  sabotage  or  war; 

-  their  unusual  concentration  of  interdependent,  exotic  resources;  and 

-  their  facilitation  of  the  manufacture  of  nuclear  bombs. 


*For  simplicity,  this  treatment  will  consider  only  fission  reactors,  not 
potential  future  fusion  reactors  (which  would  have  analogous  but  milder  safety 
and  waste  problems  and  several  significant  safeguards  problems.)  Power  reac¬ 
tors  will  be  assumed  here  to  mean  those  commonly  used  in  the  U.S. — light-water 
reactors  (LWRs) — rather  than  other  thermal-neutron  reactors  such  as  CANDU  or 
fast-neutron  reactors  such  as  the  proposed  liquid-metal  fast  breeder.  For  the 
purposes  of  this  discussion,  these  design  distinctions  do  not  give  rise  to 
important  differences  of  principle.  Our  conclusions  do  not  depend  on  differen¬ 
ces  between  once-through  and  reprocessing  fuel  cycles,  and  although  the  former 
is  likely  to  remain  the  U.S.  connercial  practice,  we  briefly  consider  the 
potential  for  major  radioactive  releases  from  reprocessing  plants. 

The  likelihood  of  releases  from  sabotage  of  large  power  reactors  may  be 
similar,  and  the  consequences  roughly  equivalent,  in  the  case  of  numerous  small 
teaching  and  research  reactors,  since  they  are  often  in  the  middle  of  large 
cities,  take  few  or  no  security  precautions,  and  have  no  containment  buildings. 
For  simplicity,  these  small  reactors  will  not  be  described  further  here,  but  a 
complete  analysis  would  have  to  consider  them  more  fully.  A  more  comprehensive 
and  documented  treatment  of  technical  issues  raised  in  this  discussion  can  be 
found  in  [Lovins  &  Price  1975;  Lovins  &  Lovins  1980];  see  also  [Ford  1981]. 

We  ignore  here  certain  Federal  nuclear  facilities,  damage  to  which  could 
have  serious  national-security  consequences  [IEAL  1980:I:2-10f ] . 
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This  analysis  concent  rates  on  the  first  of  these  threp  vulnerabilities, 
and  especially  the  extent  to  which  nuclear  facilities  can  provide  an  attractive 
target  for  sabotage  or  acts  of  war.  The  large  literature  on  major  hypothetical 
releases  of  radioact ivi ty  deals  almost  exclusively  with  accidental  releases, 
which  are  often  claimed  to  be  very  improbable.  That  analysis  tends  to  ignore 
intentional  releases,  although  it  is  common  ground  that  the  consequences  of  a 
major  release  by  either  cause  could  be  unprecedentedly  grave.  The  Atomic 
Energy  Commission's  Director  of  Regulation  agreed  [Dye  1973),  for  example,  that 
a  band  of  highly  trained,  sophisticated  terrorists  could  conceivably  destroy  a 
near-urban  reactor  so  as  to  cause  thousands,  perhaps  even  millions,  of  deaths. 
More  recently,  his  NRC  successor  agreed  [Subcommittee  on  Energy  &  the  Environ¬ 
ment  1977:8]  that  "thousands  of  lives  and  billions  of  dollars"  could  be  lost. 
Because  these  consequences  are  so  great,  it  is  important  to  establish  whether 
nuclear  terrorism  and  sabotage  are  plausible,  what  sorts  of  people  and  weapons 
might  be  devoted  to  that  end,  and  what  technical  vulnerabilities  of  nuclear 
plants  might  be  exploitable.  We  shall  therefore  consider  these  subjects  in 
turn  before  returning  to  examine  in  more  detail  the  consequences — radiological, 
social,  and  economic — of  such  acts.  This  section  will  conclude  with  a  brief 
survey  of  the  special  problems  of  illicit  nuclear  bombs. 

3.4.1.  Nuclear  terrorism:  intentions  and  incidents. 

Whether  nuclear  terrorism  is  plausible  is  best  inferred,  not  only  from  a 
study  of  the  technical  potential  for  it,  but  from  what  terrorists  have  said  and 
done.  Low-level  attacks  on  nuclear  facilities  have  in  fact  become  so  common, 
and  the  level  of  violence  is  escalating  so  steadily  [Bass  etal.  1980:77),  that 
it  seems  only  a  matter  of  time  before  major  attacks  are  successfully  attempted. 

International  terrorists  are  directly  reported  to  be  showing  an  increasing 
interest  in  nuclear  matters.  A  Europe-wide  NATO  alert  shortly  after  the  assas¬ 
sination  of  Aldo  Moro  "was  prompted  by  an  explicit  warning  from  the  West  German 
state  security  officials  of  possible  terrorist  plans  for  atomic  blackmail: 
raids  on  nuclear  bomb  depots,  kidnapping  of  specialized  NATO  officers,  hijacked 
raw  materials,  occupation  of  nuclear  plants,  to  name  a  few  possibilities  in 
what  the  Red  Brigades  speak  of  as  'a  growing  sensitization  to  international 
security  objectives.'"  [Sterling  1978:38). 

In  a  clandestine  interview  with  Stern  [Kellen  1979:61-62),  defected  German 

terrorist  Michael  Baumann  stated,  "I  do  not  want  to  suggest  that  some  group,  at 
this  time  (1978),  has  concrete  plans  or  even  definite  plans  [for  nuclear  extor¬ 
tion). ...But  nevertheless,  this  is  in  the  spirit  of  the  times"  and  has  been 


discussed  among  terrorists.  As  governments  harden  their  no-concessions  policy 

against  terrorism,  terrorists  are  driven 

...to  do  something  that  will  work  for  sure,  and  what  else  can  that  be 
except  the  ultimate  thing?  Q.  Could  that  mean  that  they  might  occupy  a 
nuclear  power  station?  A.  Sure.  These  are  intelligent  people  and  they 
have  vast  amounts  of  money.  They  also  can  build  a  primitive  nuclear  bomb. 
But  an  attack  on  a  storage  depot  is  more  likely.  After  the  killings  in 
Lebach,  the  Americans  noted  that  in  a  barracks  16  half-forgotten  nuclear 
warheads  were  stored.  Onl  a  few  German  guards  were  there  with  their 
police  dogs.  Q.  And  how  would  the. .. terrorists  proceed  in  the  course  of 
a  nuclear  action?  A.  That  is,  initially,  completely  without  importance. 
Anyone  who  has  something  like  that  [nuclear  weapons]  in  hand  has  enough 
power  to  make  the  Prime  Minister  dance  on  a  table  in  front  of  a  T.V. 
camera.  And  a  few  other  statesmen  alongside  with  him.  That  is  an  I.O.U. 
of  ultimate  power. 

While  Baumann's  statements  are  somewhat  speculative  and  cannot  be  taken  as  a 

definitive  indication  of  the  intentions  of  today's  hard-core  terrorists,  they 

are  nonetheless  a  useful  starting-point  for  further  inquiry. 

More  indirect  motives  might  also  be  important  [Bass  et  al.  1980:6]: 

Given  that  leftist  radicals  see  nuclear  programs  as  symbols  of  a  corrupt, 
militarist,  capitalist  state,  they  may  attempt  violent  actions  against 
nuclear  targets  as  a  way  to  rally  opponents  of  civilian  or  nuclear  nucle¬ 
ar  programs  to  their  cause.  European  terrorist  groups  clearly  have  iden¬ 
tified  the  antinuclear  movement  as  a  source  of  possible  supporters  and 
have  carried  out  actions  calculated  to  appeal  to  the  more  extreme  members 
of  that  movement  [who  would,  however,  be  rejected  by  their  colleagues,  the 
overwhelming  majority  of  whom  adhere  to  the  principles  of  nonviolence].... 
[I]t  has  been  reported  that  in  Italy  a  Red  Brigades  document  urged  attacks 
on  nuclear  power  plants  to  exploit  antinuclear  sentiment  in  the  country. 

Has  this  interest  actually  been  manifested  in  overt  acts  of  sabotage  and 
terrorism  against  nuclear  facilities?  Unfortunately,  the  list  of  such  inci¬ 
dents  is  already  long  and  is  growing  rapidly.  The  perpetrators  seem  no  longer 
to  be  limited  to  isolated  individual  saboteurs  and  local  semi-amateur  groups, 
but  increasingly  to  include  more  organized  and  sophisticated  international 
groups  with  access  to  a  worldwide  network  of  resources.  In  two  instances,  an 
Iraqi  "research"  reactor  has  been  overtly  attacked  by  government  aircraft  as 
an  act  of  war,  the  second  time  being  destroyed.  But  lower-level,  clandestine 
episodes  abound.  The  following  list  of  published  incidents  (plus  the  other 
examples  postponed  to  later  sections)  give  the  flavor  of  the  diversity  and  the 
gradually  escalating  intensity  and  focus  of  nuclear  terrorism  to  date.  (Inci¬ 
dents  not  specifically  documented  are  generally  given  in  Flood's  comperdium  [1976]. 

-Armed  attacks  and  bomb  explosions.  The  Atucha-1  reactor  in  Argentina, 
when  nearly  built  in  1973,  was  taken  over  by  15  armed  guerrillas  for  publicity. 


They  quickly  overpowered  five  armed  guards,  caused  only  light  damage,  and 
wounded  two  other  guards  whom  they  encountered  while  withdrawing  [Burnham  1975: 
32].  The  Trojan  reactor  in  Oregon  has  had  its  Visitor  Center  bombed  [Kupperman 
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&  Trent  1979:36],  The  Fessenheim  reactors  in  France  sustained  peripheral  site 
damage  by  fire  after  a  3  May  1975  bombing.  On  6  June  1975,  half  the  input  ter¬ 
minals  at  the  computer  center  of  Framatome  (the  French  reactor  vendor)  were 
destroyed  by  a  carefully  placed  bomb,  and  another  damaged  valve  testing  shops 
in  Framatome  workshops.  Two  bombs  set  by  Breton  separatists  on  15  August  1975 
caused  minor  damage  to  a  cooling-water  inlet  and  an  air  vent  at  the  operating 
gas-cooled  reactor  at  Monts  d'Aree,  Brittany,  which  was  closed  for  investiga¬ 
tion;  it  was  the  eighth  sabotage  attempt  in  a  month  by  the  separatists  against 
utility  installations,  and  the  most  spectacular,  using  a  boat  that  crossed  the 
artificial  cooling  lake  through  cut  fencing.  In  early  November  1976,  a  bomb 
caused  extensive  damage  at  the  Paris  offices  of  a  nuclear  fuel  manufacturer, 
and  two  more  put  a  French  uranium  mine  out  of  operation  for  about  two  months  by 
destroying  four  pump  compressors  (de  Leon  et  al .  1978:29].  In  March  1978, 

Basque  separatists  bombed  the  steam  generator  of  the  Lemoniz  reactor,  under 
construction  near  Bilbao  in  northern  Spain,  killing  two  workers,  injuring  14, 
and  causing  heavy  damage  [Bass  et  al .  1980:11],  as  part  of  ten  simultaneous 
attacks  on  scattered  facilities  of  the  plant's  construction  company,  Iberduero 
[Times  1978],  By  1981,  the  project  was  under  siege  [international  Herald  Tri-  f 

bune  1981]:  its  chief  engineer  (like  the  manager  in  1978)  had  been  kidnapped*, 

Iberduero  had  been  bombed  again  (killing  the  fourth  bomb  victim  in  three  years' 
attacks),  and  more  than  a  dozen  bomb  attacks  on  Leminoz  and  Iberduero  had  oc¬ 
curred  in  January  1981  alone.  "There  have  been  armed  assaults  on  nuclear  faci¬ 
lities  in  Spain,  and  armed  terrorists  recently  broke  into  a  nuclear  facility  in 
Italy."  [Bass  et  al .  1980:74]  Unknown  saboteurs  skillfully  blew  up  the  nearly 
completed  core  structures  of  two  Iraqi  "research"  reactors  at  a  French  factory 

on  6  April  1979.  Electronic  controls  at  the  Stanford  Linear  Accelerator  were  j 

heavily  damaged  by  two  bombs  in  1971.  Reactor  guards  at  several  U.S.  sites  I 

have  been  fired  upon  [e.g.  Subcommittee  on  Energy  &  the  Environment  1977a:247],  ' 

On  the  1976  Memorial  Day  weekend,  the  USNRC  issued  a  security  alert  to  U.S. 

nuclear  plants  on  the  basis  of  "highly  tentative  and  inconclusive  information" 

the  nature  of  which  has  not  been  disclosed  [Los  Angeles  Times  1976].  Unexploded 

bombs  have  been  found  at  the  Ringhals  reactor  in  Sweden  [de  Leon  et  al .  1978: 

29],  the  Point  Beach  reactor  in  Wisconsin  in  1970,  and  the  Illinois  Institute 
of  Technology  reactor  in  1969.  In  1975-76,  a  person  "was  arrested  for  attempt¬ 
ing  to  illegally  obtain  explosives  to  use  in  sabotaging  a  [U.S.)  nuclear  power- 
plant"  [Comptroller  General  of  the  U.S.  1977:2].  The  chief  scientist  of  the 

Iraqi  nuclear  program  was  recently  assassinated  in  Paris  (as  was  a  probable  wit¬ 
ness),  allegedly  by  Israeli  agents  (Marshall  1980a].  "Terrorists  in  Spain  have 
kidnapped  officials  of  nuclear  facilities  for  the  purpose  of  interrogat ing  them 
*He  was  later  killed  [Toth  1981]. 


102 

and  raking  their  keys  to  place  bombs  in  their  offices.  The  same  (Basque) 
terrorist  group  has  threatened  prominent  officials  in  the  nuclear  industry  with 
assassination  if  planned  nuclear  programs  were  pursued.  Terrorists  in  West 
Germany  have  placed  bombs  at  the  homes  of  those  charged  with  the  security  of 
nuclear  facilities."  [Bass  et  al.  1980:74] 

-  Insider  sabotage.  A  1971  fire  doing  $5-10  million  damage  to  the  Indian 
Point  2  reactor  in  New  York  was  set  in  an  auxiliary  building  (housing  control 
panels,  cables,  and  pumps)  while  Unit  2  was  fueled  but  not  yet  critical  and 
Unit  1  was  operating  nearby.  The  arsonist  turned  out  to  be  a  mechanic  and 
maintenance  man  at  the  plant,  had  worked  for  Con  Ed  for  seven  years,  was  an 
Army  veteran,  was  married  with  three  children,  had  tong  lived  in  the  area, 
turned  in  the  alarm  himself,  and  was  among  the  first  to  fight  the  fire  [Bass  et 
al .  1980:40] .  "A  series  of  suspicious  fires  between  June  and  November  1977 
delayed  the  completion  of  Brazil's  first  nuclear  power  plant  at  Angra  dos 
Reis."  [j^d .  ]  Worker  sabotage  has  been  reported  at  Zion  in  Illinois  in  1974 
[Emshwiller  1980a],  at  the  Fort  St.  Vrain  high-temperature  gas-cooled  reactor 
in  Colorado,  at  the  Trojan  reactor  during  its  construction  in  Oregon  in  1974, 
at  Browns  Ferry  in  Alabama  in  1980  (reportedly  including  the  disabling  of 
closed-circuit  TV  cameras)  ]  ,  and  in  Switzerland  [  Bass  et  al .  1980:74]. 

During  a  1973  strike  against  Florida  Power  &  Light  Company,  there  were  101 
incidents  of  sabotage  damaging  equipment  offsite,  and  the  FBI  was  alerted  to  a 
rumored  plan  to  sabotage  the  main  generator  at  the  Turkey  Point  nuclear  plant. 
Suspected  arson  has  occurred  at  Knolls  Atomic  Power  Laboratory  (General  Elec¬ 
tric,  New  York),  at  several  other  U.S.  nuclear  research  facilities,  and  in  1975 
in  an  equipment  storage  barn  at  the  West  Valley  (New  York)  reprocessing  plant. 
The  Winfrith,  Wylfa,  and  Berkeley  reactors  in  Britain  have  been  damaged  by 
sabotage  during  construction  or  operation — Winfrith  by  pouring  a  mercury  com¬ 
pound  into  the  calandria,  where  it  amalgamated  with  the  aluminum  alloy,  causing 
serious  damage.  Two  control-room  workers  at  the  Surry  reactor  in  Virginia  were 
convicted  in  October  1979  of  causing  $1  million  damage  to  62  unirradiated  LWR 
fuel  assemblies  by  pouring  lye  over  them  "to  bring  public  attention  to  what 
they  described  as  lax  security  and  unsafe  working  conditions  at  the  plant"  [New 
York  Times  1979].  Numerous  nuclear  facilities  of  all  kinds  received  threats, 
usually  bomb  hoaxes;  during  1969-76,  licensed  nuclear  facilities  recorded  99 
threats  or  acts  of  violence  in  the  U.S.  (76  of  them  at  federal  plants),  with 
23  analogous  threats  at  government  nuclear  plants  in  the  U.K.  By  1979-80  the 
U.S.  list  had  expanded  to  over  400  incidents,  350  of  which  were  telephoned  bomb 
threats  to  nuclear  facilities  (Bass  et  al .  1980:53].  The  list  omits  nuclear- 
related  military  incidents — such  as  11  cases  of  arson  in  three  months,  killing 
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one  worker  and  injuring  over  30  sailors,  aboard  the  nuclear-capable  aircraft 
carrier  John  F.  Kennedy,  perhaps  set  by  a  sailor  seeking  to  delay  her  sailing 
[id.  :43j  . 

-  Breaches  of  security  at  nuclear  facilities.  In  1966,  20  natural-uranium 
fuel  rods  were  stolen  from  the  Bradwell  reactor  in  England,  and  in  1971,  five 
more  disappeared  at  or  in  transit  to  the  Wylfa  reactor.  In  1971,  an  intruder 
wounded  a  night  watchman  at  the  Vermont  Yankee  reactor.  The  New  York  Univer¬ 
sity  reactor  building  was  broken  into  in  1972,  and  the  Oconee  reactor's  fresh- 
fuel  storage  building  in  1973.  The  fence  of  the  Erwin  (Tennessee)  plant 
handling  highly  enriched  uranium  was  partly  climbed  in  1974  and  fully  penetra¬ 
ted  in  1975,  both  times  without  theft  [Smith  1978:Encl.  2:App.  J# 18,29] ; 
likewise  at  the  Kerr  McGee  plutonium  plant  in  Oklahoma  in  1975.  In  1975  at  the 
Biblis  reactor  in  Germany,  1'  en  th.  world's  largest,  an  MP  carried  a  bazooka 
into  the  plant  under  his  coai  ard  presented  it  to  the  director;  a  Canadian 
Member  of  Parliament  lilt-wise  carried  an  unchecked  satchel  into  the  Pickering 
plant.  In  1977,  an  NRC  inspector  was  admitted  to  the  Fort  St.  Vrain  control 
room  unescorted  and  without  having  to  identify  himself  [Subcommittee  on  Energy 
&  the  Environment  1979:46];  similar  breaches  have  occurred  at  other  reactors. 

In  1976,  an  unstable  former  employee  drove  onto  the  Three  Mile  Island  site, 
scaled  a  security  fence,  entered  a  protected  area  next  to  the  Unit  1  reactor 
building,  and  later  drove  off  the  site  without  being  apprehended  [NRC  1976]. 

In  December  1980,  a  former  employee  used  a  long-out-of-date  security  pass  to 
enter  the  Savannah  River  plutonium  production  plant,  where  he  stole  a  truck  and 
other  equipment  from  a  high-security  area.  In  1976  more  than  a  ton  of  lead 
shielding  was  reported  stolen  from  Lawrence  Livermore  Laboratory,  a  U.S.  bomb 
design  center  [DeNike  1975].  In  1974  several  tons  of  unclassified  metal  were 
stolen  from  the  nuclear  submarine  refitting  docks  at  Rosyth,  Scotland,  appar¬ 
ently  through  a  conspiracy  of  dockyard  employees.  (Nuclear  submarine  fuel, 
available  at  the  same  docks,  is  highly  enriched  uranium,  the  most  easily  usable 
bomb  material.)  [Times  1974&; Hansard  1974]  On  5  April  1970,  a  classified  AEC 
shipment,  not  fissionable  or  radioactive,  was  stolen  in  an  armed  REA  robbery  at 
Newark  Airport  [Smith  1978 :Encl . 3 : 2 ]  .  On  14  October  1970,  "an  AEC  courier 
guarding  a  truck  shipment  of  nuclear  weapons  components"  was  held  up  and  robbed 
by  three  armed  persons  who  took  his  revolver,  wallet,  walkie-talkie,  submachine 
gun,  and  keys  to  the  truck,  but  did  not  open  or  take  the  truck  itself  [  i  d . :  3 ]  . 
In  the  fall  of  1978,  the  FBI  arrested  two  men  for  conspiring  to  steal  and  sell 

to  the  Mafia  a  berthed  nuclear  submarine  in  Connecticut,  but  prosecutors  con¬ 
cluded  they  only  meant  to  abscond  with  the  down  payment  [Bass  et  al .  1980:15]. 

-  Nuclear  thefts.  In  1978,  a  ship  carrying  200  tons  of  natural  uranium 
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was  hijacked,  allegedly  to  Israel  [J_d.:75],  breaching  EURATOM  safeguards,  but 
the  governments  concerned  kept  it  a  secret  for  nearly  ten  years.  In  1974,  a 
uranium-smuggling  operation  in  India  to  China  or  Pakistan  via  Nepal  was  exposed 
[Times  1974).  There  have  been  numerous  natural-uranium-related  crimes,  some 
involving  thefts  of  ton  quantities  [Smith  1978 : Enel . 2 : At t .A  #4;  Bass  et  al . 
1980:14-15].  In  1979,  an  employee  at  the  GE  Fuel  Processing  Plant  in  Wilming¬ 
ton,  N.C.  stole  two  30-kg  drums  of  low-enriched  uranium,  apparently  by  loading 
them  into  the  trunk  of  his  car,  and  used  them  to  try  to  extort  $100,000  from 
the  management  on  pain  of  public  embarrassment  [Subcommittee  on  Energy  &  the 
Environment  1977:4-5;  Bass  et  al.  1980:15].  Over  a  period  of  several  years, 
twenty  truckloads  of  radioactively  contaminated  tools  and  scrap  metal  were  il¬ 
licitly  dug  up  and  sold  from  a  waste  dump  in  Beatty,  Nevada  [NRC  1976a].  "Vast 
quantities  of  cannabis  resin  were  smuggled  into  Britain  in  radioactive  waste 
drums  destined  for  the  Atomic  Energy  Research  Establishment  at  Harwell,"  then 
recovered  by  asking  to  have  them  back  for  the  Pakistani  Cuscoms  [Times  1 975]. 
There  is  widespread  official  suspicion  that  at  least  a  dozen  bombs'  worth  of 
highly  enriched  uranium^were  stolen  by  insiders  from  the  NUMEC  plant  in  Apollo, 
Pennsylvania  during  the  mid-1960s  [Fialka  1979;  Burnham  1979].  Some  observers 
suspect  thefts  of  HEU  at  the  Erwin,  Tennessee  plant  too,  where  shortages  of 
material  have  persisted  for  many  years.  Minor  amounts  of  bomb  materials — not 
enough  to  make  a  bomb,  but  enough  for  materials  research  or  validating  a  threat 
— have  been  stolen  from  plants  in  North  America  (including  one  177-g  HEU  fresh 
fuel  rod  from  Chalk  River  in  Canada)  on  at  least  three  acknowledged  occasions 
[NRC  1979;  Smith  1978 :Encl . 2 : App. J  #47,  cov.  Itr.  2),  not  counting  mere  inven¬ 
tory  d i screpanc i es .  A  substrategic  shipment  of  HEU  to  Romania  arrived  with  its 
seals  tampered  with,  and  the  IAEA  did  not  confirm  it  was  all  there  for  "a 
couple  of  weeks"  [Subcommittee  on  Energy  &  the  Environment  1977:3-7]. 

-  Miscellaneous  human  and  ins t i tut ional  flaws.  "In  October  1974,  Italian 
government  officials  announced  that  they  had  discovered  a  plot  by  right-wing 
terrorists  to  poison  Italy's  aqueducts  with  radioactive  waste  material  stolen 
from  a  nuclear  research  center  in  Northern  Italy.  The  alleged  threat  was 
associated  with  revelations  of  a  planned  assassinat ion  and  political  coup  by 
right-wing  elements.  An  engineer  at  the  research  center  was  named  as  a  con¬ 
spirator  [and  a  senior  general  and  the  former  head  of  the  Secret  Service  were 
arrested],  but  the  allegations  were  never  substantiated.  The  case  became 
entangled  in  legal  technicalities.  Whether  the  alleged  plot,  which  gained 
widespread  publicity  in  Italy,  was  real  or  not  has  never  been  determined."  [de 
Leon  et  al .  1978:30]  An  analytic  laboratory  used  by  the  Japanese  nuclear 
industry  to  monitor  effluents  was  shut  down  by  the  government  for  falsifying 
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and  fabricating  test  results  [Nuclear  Engineering  International  1974a);  in 
April  1981,  a  40-day  coverup  of  improper  effluent  discharges  was  revealed  at 
Japan's  Tsuruga  reaccor.  Commonwealth  Edison  Co.  (the  most  nuclearized  U.S. 
utility)  and  two  of  its  officials  were  indicted  on  charges  of  conspiracy  to 
falsify  records  "by  omitting  the  fact  that  protective  doors  leading  to  the 
vital  area  of  the  [Quad  Cities]  plant  had  been  found  unlocked  and  unguarded" 
[New  York  Times  1980c). 

-  Malicious  use  of  nuclear  materials.  Though  many  radioactive  sources  and 
medical  radioisotopes  have  been  stolen  [Finley  et  al .  1980:App.l;  AP  1974; 
Nuclear  News  1974;  Los  Angeles  Times  1974,1974a;  de  Leon  et  al .  1978:30],  and 
some  shipments  of  strategic  materials  have  been  misrouted,  mislaid,  or  even 
dropped  off  trucks  [Finley  et  al .  1980:H-4],  only  three  instances  of  malicious 
use  are  known  so  far:  a  Squibb  radiopharmaceuticals  worker  put  131 1  in 
another's  drink  (causing  a  3.8-pCi  thyroid  uptake)  [E.R.  Squibb  &  Sons,  Inc. 
1971);  a  hated  supervisor  at  the  Cap  de  la  Hague  reprocessing  plant  was  exposed 
during  six  months  to  about  10-15  R/h  of  hard  gamma  radiation  from  stolen  wastes 
secreted  under  the  seat  of  his  car  by  a  worker  [Daily  Mail  1979a;  Not  Man  Apart 
1981);  and  in  April  1974  the  interior  of  some  train  coaches  in  Vienna  was 
sprinkled  with  substantial  but  nonlethal  amounts  of  131^  [je  Leon  et  al . 
1978:30],  contaminat ing  at  least  twelve  passengers.  There  have  been  reports 
[Bass  et  al .  1980:77]  of  the  use  in  Europe  of  nuclear  materials  in  an  attempted 
suicide,  and  that  a  thief  who  tampered  with  a  stolen  radioactive  source  may 
well  have  been  killed  by  it  [AP  1974],  A  Tulsa  radiographer  died  of  radiation 
apparently  received  from  a  stolen  192Ir  source  [New  York  Times  1981a]. 

3.4.2.  Nuclear  terrorism:  resources. 

The  foregoing  history  of  actual  incidents  of  nuclear  terrorism,  sabotage, 
theft,  and  related  institutional  failures  shows  an  increasing  involvement  by 
international  terrorist  groups,  and  a  considerable  scope  for  more.  It  is 
therefore  inportant  to  examine  what  sorts  of  resources  such  a  group  can  bring 
to  bear  on  nuclear  facilities.  These  resources  help  to  determine  the  achiev¬ 
able  level  of  damage.  In  the  substantial  literature  of  nuclear  threat  assess¬ 
ment  [e.g.  Wagner  1977],  most  of  the  studies  commonly  quoted  to  reassure  the 
public  that  nuclear  plants  are  very  resistant  to  sabotage  expressly  exclude  the 
possibility  of  "military  action  and  damage  by  foreign  agents  or  subversive 
organizations"  [e.g.  Turner  et  al ■  1970];  that  is,  they  consider,  in  practical 
effect,  only  lone  disgruntled  employees  and  the  like.  But  international  groups 
have  far  greater  resources,  and  some  can  even  call  on  the  resources  of  wealthy 
governments,  which  in  turn  may  find  such  a  connection  useful  for  their  own 
ends.  "Finding  modern  conventional  war  inefficient,  uneconomical,  and  ineffec- 
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five,  some  nations  may  be  drawn  to  exploit  the  demonstrated  possibilities  and 
greater  potential  of  terrorism,  and  employ  terrorist  groups  or  tactics  in  sur¬ 
rogate  warfare  against  other  nations.  This  requires  an  investment  far  smaller 
than  the  cost  of  a  conventional  war;  it  debilitates  the  enemy;  and  it  is 
deniable."  [RAND  1980:12]  Who  are  these  possible  surrogates  and  what  are 
their  strengths  and  resources? 

There  are  estimated  to  be  about  fifty  terrorist  organizations  in  the 
world,  with  a  total  of  about  three  thousand  active  members,  perhaps  an  equal 
number  of  peripheral  supporters,  and  about  two  hundred  members  constituting  the 
"primary  transnational  threat"  [Kupperman  &  Trent  1979:5].  Several  groups 
sometimes  participate  jointly  in  an  action.  This  makes  it  difficult  to  deter¬ 
mine  how  many  terrorists  might  be  expected  to  join  in  a  single  attack  on  a 
particular  nuclear  facility.  In  the  U.S.,  where  the  nuclear  regulatory  philo¬ 
sophy  encourages  formulation  of  specific  threat  levels  which  licensees  are  to 
guard  against,  there  is  a  long-running  debate  over  this  number,  and  it  has 
risen  steadily  during  the  past  ten  years.  At  first  it  was  thought  to  be  "seve¬ 
ral,"  meaning  three,  of  whom  one  could  be  an  insider,  and  there  was  a  consensus 
that  security  systems  were  not  adequate  for  this  threat  [Eschwege  1974:2;  Sub¬ 
committee  on  Energy  &  the  Environment  1977:204].  Upgraded  security  measures 
were  then  again  outrun  by  a  heightened  threat  estimate  of  a  "small  group"  (six) 
aided  by  up  to  two  insiders.  More  recently,  after  several  official  studies,  a 
consensus  has  emerged  that  "fifteen  highly  trained  men,  no  more  than  three  of 
[ whom] .. .work  within  the  facility...,  [the  insiders  to  include]  anyone  up  to 
the  higher  levels  of  management,"  is  a  reasonable  threat  level  [Rosenbaum  et 
al .  1974:S6623;  Cochran  1977],  But  this  debate  is  reminiscent  of  medieval 

theologians'  disputations,  since  the  history  of  criminal  and  terrorist  enter¬ 
prises  clearly  shows  that  attackers  bring  with  them  "as  many  as  they  need... to 
do  the  job,  and  no  more.  The  fact  that  most  came  with  a  handful  of  persons,  3 
to  6,  thus  does  not  represent  an  upper  limit  on  their  capacity"  but  only  their 
estimate  of  what  would  be  "necessary  to  accomplish  their  mission"  [Office  of 
Technology  Assessment  1977a:197].  More  stringent  security  precautions  would 
simply  elicit  a  stronger  attack  without  obvious  limit. 

Another  warning  against  underestimating  attackers  comes  from  a  review  [de 
Leon  et  al .  1978:42]  of  past  commando  raids.  Most  "were  carried  out  against 
protected  targets  at  least  as  well  armed  as  the  commandos,  conditions  that 
would  hardly  seem  to  bode  well  for  the  raiders.  Vet,  with  the  advantages  of 
greater  flexibility  and  tactical  surprise,  the  raids  succeeded  three-fourths  of 
the  time  and  against  some  targets  whose  defenses  could  have  prevailed  against 
much  larger  forces:  if  one  excludes  those  failures  that  were  not  due  to  enemy 

i 

' 

f 

1 

_ _ i 


107 


A 


t 

action,  the  comrtbndos  were  successful  almost  90  percent  of  the  time.  This  rate 
of  success  speaks  highly  for  the  professional  skill  and  ingenuity  of  the 
raiders,  and  particularly  for  their  use  of  surprise,  (it  also  bodes  ill  for 
the  use  of  mathematical  engagement  models  lor  security  plans]  in  which  force 
ratios  determine  the  outcome.)" 

The  success  of  such  raids  depends  on  accurate  intelligence  and  precise 
planning — especially  in  such  operations  as  Palmach's  destruction  of  eleven 
bridges  in  one  night,  or  raids  in  which  British  and  Israeli  commandos  seized 
and  carried  off  German  and  Egyptian  radar  bases  respectively  [id.:19].  Similar 
attributes  determined  the  success  of  task-force  crimes.  "In  the  45  cases 
reviewed,  criminals  were  able  to  assemble  teams  of  as  many  as  twenty  people 
(yet  remain  undiscovered),  breach  thick  walls  and  vaults  and  neutralize  modern 
alarm  systems,  and  devote  up  to  2  years  of  planning  for  a  single  'caper.'"  [id.: 
v i ] .  Considerable  technical  sophistication  has  also  been  displayed  [id.  12; 
Burnham  1975:57-59].  "In  1970,  an  electronics  expert  connected  with  organized 
crime  was  detected  in  what  appeared  to  be  an  elaborate  method  of  monitoring  the 
activities  of  the  Chicago  police.  He  was  cruising  near  the  Chicago  Police 
Department's  lake  front  headquarters  in  a  converted  mine-sweeper  laden  with 
radio-intercept  equipment."  [id. : 59] .  It  is  commonly  asserted  that  no  group 
as  large  as,  say,  a  dozen  people  could  be  assembled  and  trained  for  a 
nuclear  plant  attack  without  coming  to  the  authorities'  attention;  but  larger 
groups  in  past  criminal  efforts  have  escaped  both  notice  beforehand  and  capture 
afterwards.  Indeed,  13  mercenaries  training  with  automatic  weapons  for  jungle 
warfare  were  arrested  for  trespass  after  five  days'  secret  maneuvers  on  the 
borders  of  the  Crystal  River  nuclear  power  plant  in  Florida  [Prugh  1981].  They 
were  observed  more  or  less  by  accident,  and  nobody  knew  who  they  were — whether 
they  were  "a  drug-offloading  operation,  a  subversive  group  trying  to  get  the 
power  plant  or  a  CIA  operation,"  according  to  the  sheriff.  His  aide  added: 

"If  they  were  the  real  McCoy,  we  wouldn't  have  been  any  match  for  ’em.... This 
damn  sure  oughta  wake  up  the  nuclear  power  industry ... .A  good  assault  team 
could  have  taken  that  plant."  [id.]  The  month  after  the  13  mercenaries  were 
released  on  their  own  recognizance,  two  of  them  were  rearrested  with  guns  and 
explosives  in  Miami,  where  it  was  believed  they  were  about  to  plant  a  bomb  [Los 
Angeles  Tiroes  1 98 1 h ]  . 

Such  a  straightforward  light-infantry  group  is  a  less  formidable  threat, 
however,  than  just  one  or  two  insiders  with  knowledge  of  and  access  to  the 

plant's  vital  areas.  Insider  aid  has  characterized  many  of  the  biggest  and 
smoothest  thefts  and  hijackings  [de  Leon  et  al .  1978:13f;  Bass  et  al .  1980:17). 
(Impersonation  of  insiders  has  also  worked  every  time  it  was  tried  (de  Leon  et 
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a_l_.  1978:14].)  "In  the  $5.8  million  theft  from  Lufthansa  at  the  JFK  Airport,  a 
ten-year  Lufthansa  employee  was  promised  $300,000  (more  than  any  other  partici¬ 
pant  )...[  s  imp  iy  to  leave]  his  post  for  more  than  an  hour  and  a  half."  (Bass  et 
al •  1980:17]  A  Bank  of  New  Mexico  burglary  on  the  Sandia  nuclear  base  in  1955 
appears  to  have  had  inside  help  on  the  base  [de  Leon  et  al .  1978:13],  and  other 
examples  cited  above  indicate  that  even  nuclear  facilities  requiring  the  most 
stringent  clearance  and  vetting  of  employees  may  harbor  potential  criminals. 

The  former  security  director  of  the  Atomic  Energy  Commission  was  himself  sen¬ 
tenced  to  three  years'  probation  in  1973  after  borrowing  $239,000  from  fellow 
AEC  employees,  spending  much  of  it  at  the  racetrack,  and  failing  to  repay  over 
$170,000  [ Satchel  1  1973]  . 

A  particularly  worrisome  sort  of  insider  help  is  security  guards.  As  of 
1977  [Comptroller  General  of  the  U.S.  1977:8],  guard  forces  at  many  reactors 
not  only  were  of  low  quality,  but  had  a  turnover  rate  of  a  third  to  a  half  per 
year,  with  departing  guards  taking  with  them  an  intimate  knowledge  of  up-to- 
date  security  arrangements.  A  local  newspaper  reporter  got  a  job  as  a  security 
guard  at  Three  Mile  Island,  then  prepared  a  series  of  articles  which  the  utili¬ 
ty  unsuccessful ly  sought  an  injunction  to  suppress  on  the  grounds  that  reveal¬ 
ing  "the  specific  details  of  the  security  system. . .presents  a  significant, 
serious,  grave  security  threat .... [ T ] here  is  a  threat  to  the  health  of  the 
public,  and  national  security  is  involved  if  someone  gets  in  there  to  hold  the 
plant  hostage  for  whatever  reason."  [New  York  Times  1980b] 

A  U.S.  Marshals  Service  review  of  reactor  guard  forces  in  1975  [Comptrol¬ 
ler  General  of  the  U.S.  1977:9]  found  they  had  weak  allegiance,  high  turnover 
rate,  poor  background  checks  and  supervision,  inferior  equipment,  weak  legal 
authority,  poor  rapport  with  local  police,  poor  mobility,  no  uniform  physical¬ 
fitness  standards,  low  public  confidence,  and  little  training.  Many  of  these 
weaknesses  persist  today.  Background  checks  have  been  a  particularly  sore 
point  since  a  convicted  and  paroled  armed  robber  got  a  job  as  a  security  guard 
under  an  alias  at  the  former  Kerr  McGee  plutonium  fuel  fabrication  plant  in 
Oklahoma;  he  was  found  out  and  fired  in  1974,  then  six  months  later  arrested  in 
connection  with  an  attempted  bank  robbery  in  which  a  woman  was  shot  [Smith 
1 978 : Enc l . 2 : App . J#8] .  Even  with  honest  guards,  breaches  of  security  are  fairly 
common.  A  woman  working  at  Browns  Ferry  forgot  she  had  a  pistol  in  her  purse 
and  carried  it  through  a  guardpost  undetected  in  February  1980  [Emshwiller 
1980a: 13];  GAO  auditors  in  1977  "were  able  to  pick  the  locks  and  open  several 
doors  to  vital  areas  of  [a  nuclear  power]  plant  by  using  a  screwdriver  or  a 
piece  of  wire... found  on  the  ground  near  the  door"  [Comptroller  General  of  the 
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U.S.  1977:15);  and  other  breaches  too  numerous  to  mention  have  elicited  NRC 
fines  of  utilities  on  almost  a  monthly  basis. 

Except  at  the  eleven  federal  facilities  handling  bomb  material,  where  new 
protective  devices  include  armored  cars  with  light  machine  guns,  U.S.  nuclear 
plants  are  defended  by  small  numbers  of  guards  with  conventional  light  arms. 
These  are  clearly  no  match  for  the  sort  of  firepower  that  even  a  handful  of 
terrorists  could  deploy  against  a  nuclear  (or  any  other  sort  of  energy)  facili¬ 
ty.  These  potential  weapons  include  the  following  main  categories: 

-  Firearms:  past  terrorist  and  criminal  attacks  have  used  all  available 
civilian  and  military  firearms  up  to  and  including  heavy  machine  guns,  20mm 
cannons,  antitank  guns,  and  recoilless  rifles.  Modern  counterinsurgency  arms 
now  available  to  terrorists  include  [Jenkins  1975a:14]  "tiny — some  less  than  15 
inches  long — silent  submachine  guns."  Automatic  weapons  are  readily  available 
[Burnham  1975:69).  "Enough  weapons  and  ammunition  to  outfit  10  combat  battal¬ 
ions  numbering  8000  men  were  stolen  from  U.S.  military  installations  around  the 
world  between  1971  and  1974"  [Aspin  1975). 

-  Mortars — especially  well  suited  for  attacks  on  spent  fuel  pools,  switch¬ 
yards,  and  other  facilities  unprotected  from  above.  A  single  North  Vietnamese 
mortar  team  caused  about  $5  billion  damage  to  the  U.S.  airbase  at  Pleiku.  "A 
Belgian  arms  manufacturing  firm  has .. .developed  a  disposable,  lightweight, 
silent  mortar  which  can  be  used  against  personnel  and  also  fires  a  projectile 
with  a  spherical  warhead  designed  to  produce  a  'shattering  effect'  suis*!&,„<‘  for 
the  'destruction  of  utilities,  communications,  and  light  structures.'  The  full 
field  unit,  which  weighs  only  22  pounds,  includes  the  firing  tube  plus  seven 
rounds.  All  seven  rounds  can  be  put  in  the  air  before  the  first  round  hits." 
[Jenkins  1975a:14j 

-  Bazookas  and  similar  unguided  rockets.  Aspin  [1975)  notes  that  "In 
August  1974,  ninety  anti-tank  weapons  were  stolen  by  a  Yugoslav  national  who 
was  an  employee  of  the  U.S.  Army  in  Germany."  These  were  recaptured,  but  many 
more  were  stolen  and  later  turned  up  in  the  hands  of  criminals  and  terror¬ 
ists.  Their  shaped-charge  warheads  are  specifically  designed  to  penetrate 
thick  armor.  World  War  II-vintage  bazookas  have  a  range  of  nearly  400  m.  Their 
contemporary  version,  the  U.S.  Light  Antitank  Weapon  (LAW),  is  a  five-pound 
rocket  effective  at  300  m  against  stationary  targets,  and  shoulder- fired  from  a 
disposable  tube  [Kupperman  &  Trent  1979:56).  One  was  unsuccessfully  fired  at  a 
West  Coast  police  station  in  1974;  many  have  been  stolen  [Burnham  1975:69).  The 

similar  Soviet  RPG-7  was  used  in  the  Orly  Airport  attack  in  January  1975.  Both, 
and  counterparts  such  as  the  French  Strim  F-l,  are  portable,  suitcase-sized, 
and  easy  to  conceal  or  disguise.  "[T)here  has  not  been  a  recent  Soviet-influ- 


enced  conflict  in  which  the  recipients  of  Russia's  support  were  not  carrying 
RPC-7s"  [Kupperman  4  Trent  1979:83).  Still  deadlier  versions  are  now  under 
development,  with  ranges  "far  greater"  than  300  m  [  id . :  56)  . 

-  Light,  precision-guided  rockets  designed  for  shoulder-firing  against 

ai rcraf t  (like  the  Soviet  SA-7  or  "Strela"  and  the  U.S.  "Redeye",  both  of  which 
have  terminal  infrared  guidance  and  a  range  of  several  km).  Redeye  weighs 
under  30  pounds  and  is  about  four  feet  long;  its  successor,  "Stinger,"  is  no 
bigger  but  is  faster,  longer-range ,  and  more  accurate  [Jenkins  197 5a : 1 3] .  The 
British  "Blowpipe"  is  radio-guided  by  its  aimer;  the  supersonic,  tripod-mounted 
Swedish  RB-70  has  laser  guidance,  "weighs  under  180  pounds,  breaks  down  into 
three  smaller  packages,  and  can  be  operated  by  one  man  with  minimal  training". 
These  latter  two  missiles  can  shoot  down  aircraft  approaching  head-on  [  id .  1  . 
Palestinian  terrorists  have  Strela  rockets  and  were  arrested  with  some  near  the 
Rome  Airport  in  September  1973  and  at  the  edge  of  the  Nairobi  airport  in 
January  1976  [Kupperman  &  Trent  1979:30-31).  A  Strela  may  have  been  used  to 
shoot  down  two  Rhodesian  passenger  planes  in  the  past  three  years.  It  could 
be  used  both  for  standoff  attacks  on  stationary  facilities  and  to  shoot  down 
incoming  airborne  security  forces. 

-  Analogous  precision-guided  munitions  (PGMs)  designed  for  antitank  use. 
The  U.S.  "Dragon"  and  TOW  rockets  and  the  f.  net  "Sagger"  are  wire-guided,  use 
laser  target  acquisition,  have  ranges  of  several  km,  weigh  generally  under  30 
pounds,  and  can  be  carried  and  operated  by  one  person.  The  French/German 
"Milan,"  somewhat  smaller  and  with  semiautomatic  guidance,  is  even  more  port¬ 
able  and  is  being  deployed  by  the  tens  of  thousands  [Jenkins  1975a:I4).  The 
Dragon,  TOW,  and  Sagger  shaped-charge  warheads  "can  pierce  several  feet  of 
homogeneous  armor  plate"  [Kupperman  6  Trent  1979:55).  They  are  more  commonly 
available  than  their  anti-aircraft  counterparts.  It  would  not  be  surprising  if 
at  least  hundreds  of  them  were  in  terrorists'  hands  today.  They  are  ideal  for 
standoff  attacks  against  even  semihardened  nuclear  facilities,  as  well  as  for 
attacking  any  vehicles  in  which  security  forces  would  be  likely  to  arrive. 

-  Specialized  rockets  and  grenades.  The  German-designed  antitank  "Arm- 
brust  300,"  designed  for  urban  warfare,  "has  no  backblast,  making  it  possible 
to  fire  the  weapon  from  inside  a  room — something  no  rocket  launcher  can  do  now. 
The  Germans  expect  to  produce  the  'Armbrust'  in  large  quantities."  [Jenkins 
I975a:l4)  A  new  projectile  that  can  be  fired  from  the  U.S.  M-79  grenade 
launcher  (many  of  which  have  reportedly  been  stolen)  "is  capable  of  penetrating 
two  inches  of  armor  plate  and  igniting  any  fuel  behind  it."  [ id . ) 

-  Poison  gas.  In  April  1975,  terrorists  stole  three  liters  of  mustard  gas 
from  German  Army  bunkers;  several  cities,  including  Stuttgart  and  Bonn,  were 
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threatened  with  a  gas  attack  [Guard i an  1975a]  .  The  "Alphabet  Bomber"  threat¬ 
ened  in  1974  to  "destroy  the  entire  personnel  of  Capitol  Hill"  with  two  tons  of 
sarin  nerve  gas,  and  had  in  fact  assembled  all  but  one  of  the  ingredients  need¬ 
ed  to  make  it  [Bass  et  al .  1980:25-26].  A  letter  bomb  containing  a  vial  of 

nerve  gas  has  reportedly  been  intercepted  in  the  United  States  [Evening  Stand¬ 
ard  1976],  Viennese  police  in  1975  arrested  German  entrepreneurs  for  conspir¬ 
ing  to  sell  tabun  nerve  gas  in  the  Middle  East  [Kupperman  &  Trent  1979:5];  they 
had  already  made  a  liter  of  it — a  mere  whiff  of  which  would  cause  unconscious¬ 
ness  in  five  seconds  and  death  within  five  minutes — and  packed  it  into  bottles, 
capsules,  and  spray  cans  [Evening  Standard  1976;  Ottawa  Citizen  1976]  .  Methods 
of  making  such  substances  have  been  published,  and  some  highly  toxic  nerve-gas 
analogues  are  commercially  available  in  bulk  as  organophosphorus  insecticides. 
An  inhaled  lethal  dose  of  sarin  nerve  gas  to  a  normally  respiring  70-kg  person 
is  about  1  mg.  VX  nerve  gas,  whose  method  of  preparation  has  also  been  printed, 
is  ten  times  this  toxic  by  inhalation  and  300  times  as  toxic  by  contact  [Kup¬ 
perman  &  Trent  1979:65],  and  can  bp  made  by  a  "moderately  competent  organic 
chemist,  with  limited  laboratory  facilities"  and  willingness  to  take  risks 
[Jd^.  ]  .  Nonlethal  incapacitating  gases  like  Mace®  are  also  widely  available. 

-  Explosives,  including  breaching,  shaped,  platter,  airblast,  and  fuel-air 
detonation  charges.  These  are  readily  available  at  a  wide  range  of  sophistica¬ 
tion,  ranging  from  disguisable  plastic  explosives  and  specialized  cutting  and 
penetration  jets  to  the  crude  770-kg  truckload  of  fert i 1 i zer/fuel-oi 1  explosive 
which  destroyed  the  Army  Mathematics  Research  Center  at  the  University  of 
Wisconsin  in  1970  [Pike  1972].  (Such  «  charge  at  10  m  produces  overpressures 
of  order  150  psi,  six  times  the  level  severely  damaging  reinforced  concrete.) 
Many  tons  of  coimnercial  explosives  are  stolen  every  year  [Burnham  1975:50]. 
Nuclear  explosives  offer  special  capabilities  that  will  be  considered  below. 

-  Aircraft .  The  same  group  that  caused  one  death  and  $6  million  in  damage 
with  the  ANFO  truck  bomb  at  the  University  of  Wisconsin  had  also  tried  to  sabo¬ 
tage  a  power  station  supplying  a  munitions  plant,  and  had  made  an  unsuccessful 
aerial  attack  in  a  stolen  airplane  against  the  same  munitions  plant  [Burnham 
1975:49].  Fixed-wing  aircraft  have  been  used  in  several  bombing  attempts,  par¬ 
ticularly  in  Northern  Ireland.  Helicopters  have  been  used  in  jailbreaks  in  the 
U.S.  [de  Leon  et  al ■  1978:35]  and  in  Mexico  and  Eire,  and  by  Pfc.  Robert  K. 
Preston  in  his  17  February  1974  landing  on  the  White  House  lawn.  Palestinian 
terrorists  have  recently  used  even  a  hot-air  balloon  to  enter  Lebanon,  and  of 

course  Nazi  commandos  often  used  gliders  with  great  success.  Commercial  and, 
on  occasion,  even  military  aircraft  are  hijacked  throughout  the  world,  and 
could  be  used  for  access,  weapon  delivery,  or  kamikaze  attack. 


112 


-  Ships,  small  submersible  vessels,  and  frogmen  are  undoubtedly  available 
to  terrorists.  Ships  carrying  torpedoes,  depth  charges,  and  guided  rockets  may 
be  available.  Portable  missiles  can  be  fired  even  from  a  rowboat. 

-  Tanks  and  similar  vehicles  are  sufficiently  available  at  National  Guard 
and  Army  bases,  where  a  wide  variety  of  other  sizable  weapons  have  been  stolen 
in  the  past,  that  it  is  not  unrealistic  to  contemplate  their  hijacking.  Some 
incidents  of  this  kind  have  already  occurred.  Just  heavy  construction  equip¬ 
ment,  which  is  commonly  available  to  civilians,  lends  itself  to  adaptation,  and 
could  readily  be  armored  to  withstand  the  light-infantry  arms  issued  to  guards. 
In  Louisiana  in  June  1967,  a  large  construction  crane  was  driven  into  three 
large  transmission-line  towers  to  destroy  them  [McCullough  et  al .  1968). 

3.4.3.  Sabotage  of  nuclear  facilities. 


With  such  firepower  at  their  command,  what  technical  vulnerabilities  might 
enable  terrorists  (or  acts  of  war)  to  achieve  major  releases  of  radioactivity 
from  nuclear  facilities? 

The  first  thing  to  be  understood  about  those  facilities  is  that  their 
radioactive  inventories  are  very  large.  The  magnitudes  involved — and  the  dili¬ 
gent  attention  needed  to  prevent  their  accidental  release — can  be  illustrated 
by  a  few  simple  examples.  At  equilibrium,  a  1-GWe  LWR  contains  over  15  GCi* 
of  radioactivity,  including  about  12.5  GCi  of  fission  products  and  3.1  GCi  of 
persistent  transuranic  elements  such  as  plutonium.  Among  the  more  important 
fission  products  is  72  MCi*  of  volatile  iodine-131  (*^l),  a  thyroid-seeker 
with  a  half-life  of  about  a  week.  (This  means  that  half  of  its  remaining  radi¬ 
oactivity  decays  weekly,  so  that  after  ten  half-lives  it  is  reduced  to  l/1024th 
of  its  original  potency;  after  twenty  half-lives,  to  just  under  a  millionth; 
and  so  on.)  Holdren  [1974]  points  out  that  a  quarter  of  that  ^lj  inven¬ 
tory  would  suffice  to  contaminate  the  atmosphere  over  the  48  coterminous  States 
to  an  altitude  of  10  km  to  twice  the  maximum  permissible  concentration  (MPC) 
for  that  isotope.  Half  of  the  5.2-MCi  inventory  of  the  important  bone-seeking 
fission  product  strontium-90  (^®Sr),  which  has  a  28-year  half-life,  would 
suffice  to  contaminate  the  same  area's  annual  freshwater  runoff  to  six  times 
the  MPC.  Such  estimates  are  used  not  to  suggest  that  such  widespread,  uniform 
dispersion  would  actually  occur,  but  to  stress  the  exquisite  care  that  contain¬ 
ment  of  such  large  inventories  demands. 

Another  calculation  [Morrison  et  al .  1971]  assumes  that,  in  accordance 
with  the  "design  basis  accident,"  all  the  radioiodine  in  a  1-GWe  LWR  is  vola- 


*0ne  curie  (Ci)  undergoes  37  billion  disintegrations  per  second — the  activity 
of  a  gram  of  radium.  One  GCi  (billion  Ci)  or  MCi  (million  Ci)  is  a  huge  unit. 
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tilized  and  half  of  it  enters  the  containment  dome.  If  that  containment  then 
fails  or  is  deliberately  breached,  then  half  of  its  radioiodine  inventory  (a 
quarter  that  in  the  core),  held  up  for  a  day  (4.6-fold  decay),  will  produce 
under  moderately  stable  meterologi cal  conditions  a  cloud-centerline  dose  of  300 
rem  to  an  adult  thyroid  at  a  downwind  range  of  200  km.  Such  a  dose,  while  not 
acutely  dangerous  (as  a  300-rem  whole-body  dose  would  be),  is  certainly  more 
than  would  be  considered  tolerable.  Before  placing  too  much  faith  in  the  con¬ 
tainment,  it  is  worth  noting  that  the  integrated  decay  heat  from  the  core  would 
suffice  to  melt  down  through  an  iron  cylinder  3.3  m  in  diameter  and  over  210  m 
high  l  _i_d_.  ] — to  say  nothing  of  possible  steam  or  hydrogen  explosions  or  other 
effects  involving  thermal  shock,  carbon  dioxide  pressure  from  decomposing 
concrete,  etc.  This  decay  heat,  arising  from  radioactive  decay  in  the  core, 
cannot  be  turned  off,  reduced,  or  controlled  in  any  way,  and  must  be  safely 
removed  somehow — a  key  distinction  between  nuclear  heat  and  heat  from  chemical 
combust i on . 

This  decay  heat — initially  about  6-10%  of  the  reactor's  full-power  heat 
output,  thus  amounting  to  hundreds  of  megawatts  for  a  modern  power  reactor — is 
only  one  of  its  several  sources  of  internal  energy  which,  properly  harnessed, 
can  help  a  saboteur  to  release  much  of  the  core's  radioactivity,  even  if  the 
reactor  has  already  been  shut  down.  Another  is  the  potential  for  chemical 
reactions  (such  as  Z i rca loy/water  or  hydrogen/oxygen).  Yet  another  is  the 
pressures  and  momenta  of  internal  fluids:  in  a  big  PWR,  the  mechanical  energy 
of  circulating  hot  water  is  equivalent  to  about  0.023  kT ,  and  its  thermal 
energy,  to  several  kT .  Much  of  the  reactor's  complexity  arises  from  multiple 
protective  devices  which  are  supposed  to  prevent  a  major  release;  but  these  all 
have  their  vulnerabilities. 

Among  these  is  their  need  for  electric  power.  Without  electricity,  most 
of  the  shutdown,  cooling,  and  control  devices  cannot  work.  Few  have  adequate 
battery  storage;  instead,  they  rely  on  offsite  power  from  the  grid,  onsite 
power  from  the  station's  own  switchyard,  or  emergency  diesel  generators  (which 
are  not  very  reliable).  The  Rasmussen  Report's  fault  and  event  trees  [NRC 
1975]  reveal  that  common-mode  electrical  failure  causes  severe  and  unstoppable 
meltdowns  in  which  most  mitigating  devices  do  not  work.  Low-technology  sabotage 
could  disable  diesel  generators  in  between  their  periodic  tests,  then  at  leis¬ 
ure,  before  they  are  fixed,  cut  offsite  power.  One  person  without  special 
skills  could  do  both,  either  by  access  to  the  site  or  (in  most  cases)  by  stand¬ 
off  attack,  as  the  diesels  are  often  badly  protected  and  sometimes  housed  in 
light  external  sheds.  Operating  power  reactors  have  already  experienced  fail¬ 
ure  of  all  backup  power  (fortunately  not  simultaneous  with  a  grid  outage) 
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[Pollard  1979:42]  and  tad  grid  instability  resulting  in  reactor  shutdown  and 
area  blackouts  [  id . :46] . 

More  complex  modes  of  attack  can  be  designed  with  the  aid  of  the  Rasmussen 
Report  and  detailed  design  information  publicly  available  [Subcommittee  on 
Energy  &  the  Envt.  1977:215].  They  can  either  mimic  hypothetical  accident 
sequences,  as  most  analyses  assume  is  necessary,  or  simplify  and  shortcut 
them.  Two  promising  approaches  are  producing  a  rapid  power  excursion,  beyond 
the  reactor's  ability  to  cool  the  fuel  (a  worrisome  class  of  potential  acci¬ 
dents,  especially  in  BWRs) ,  and  "interrupting  the  supply  of  cooling  to  a  shut¬ 
down  reactor "  [Jd. ;  14]  so  that  its  decay  heat — initially  many  kWt  per  liter  of 
core  ““melts  the  fuel.  These  can  be  done  from  either  onsite  or  offsite,  the 
latter  referring  to  remote  targets  or  to  use  of  standoff  weapons  against  the 
plant  itself.  Remote  targets  include  transmission  lines,  related  switchyards 
and  transformers  not  onsite,  and  any  cooling-water  intake  necessary  to  provide 
an  ultimate  heat  sink  to  the  plant:  for  any  power  plant,  but  especially  for 
nuclear  plants  because  they  need  cooling  for  decay  heat  after  shutdown,  "the 
screenhouse  [intake  structure]  is  probably  the  most  vulnerable  point  for  sabo¬ 
tage  in  steam  generating  stations."  [Bisset  1958]  (This  may  also  be  one  of  the 
things  Dr.  Bruce  Welch,  a  former  Navy  Underwater  Demolitions  officer,  had  in 
mind  in  his  widely  publicized  Joint  Committee  on  Atomic  Energy  testimony,  28 
March  1974,  that  with  a  few  randomly  selected  military  demolition  people  he 
"could  sabotage  virtually  any  nuclear  reactor  in  the  country."  A  retired  Green 
Beret  colonel,  Aaron  Bank,  gave  unpublished  JCAE  testimony  to  similar  effect 
about  San  Onofre,  whose  intake  structures  are  unusually  accessible.)  Standoff 
weapons,  besides  conventional  ones  such  as  mortars,  rockets,  precision-guided 
munitions,  fixed-wing  and  helicopter  aircraft,  etc.,  may  include  remotely  pilo¬ 
ted  aircraft  (the  remote-control  apparatus  now  widely  available  to  hobbyists  is 
probably  adaptable  to  operating  standard  light  aircraft).  Inspection  of  seis¬ 
mic  resonance  analyses  of  major  reactor  structures  also  suggests  that  an  exotic 
possibility — standoff  attack  by  infrasound  generators  tuned  to  published  reso¬ 
nant  frequencies — cannot  be  wholly  disregarded;  and  of  course  key  control  and 
safety  circuitry,  as  noted  on  p.96,  may  be  vulnerable  to  electromagnetic  puls¬ 
es,  fair  facsimiles  of  which  can  be  generated  with  homemade  standoff  devices. 

Onsite  overt  attacks  could  be  meant  to  take  over  the  plant.  The  staff 
could  be  subdued  or  killed  with  ordinary  weapons  or  by  introducing  a  rapidly 
lethal  gas  into  the  ventilating  system.  The  latter  method  might  be  quick 
enough  to  prevent  operators  from  raising  the  alarm,  isolating  control-room 
ventilation,  or  shutting  down  the  reactor,  and  it  might  be  the  method  of  choice 
for  an  insider.  (It  also  raises  the  question,  nowhere  answered  in  the 
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literature,  of  how  safe  a  power  reactor  would  remain  if  all  its  staff  suddenly 
dropped  dead.)  Once  the  plant  had  been  seized,  its  security  devices  and  the 
shielding  and  life-support  systems  of  the  control  room  would  all  help  to 
protect  its  occupiers  from  both  invaders  and  external  radioactive  releases. 

The  occupants  could  then  do  either  of  two  things,  or  both  in  succession,  at 
comparative  leisure. 

First,  they  could  use  their  power  over  the  costly  plant  and  its  dangerous 
contents  as  a  basis  for  political  negotiations.  These  might  be  secret  initial¬ 
ly,  with  the  threat  of  disclosure  and  ensuing  public  panic  used  as  a  bargaining 
chip.  Various  concessions  could  be  demanded.  In  their  absence — or  possibly 
straightaway  if  the  occupiers  are  of  the  type  that  prefer  people  dead  to  people 
watching,  or  cannot  competently  maintain  the  plant  in  safe  condition — serious 
damage  could  be  undertaken,  leading  at  a  minimum  to  the  economic  loss  of  the 
plant  and  probable  ruin  for  its  owners;  at  a  maximum,  to  major  releases. 

Two  types  of  deliberate  damage,  not  mutually  exclusive,  seem  possible. 

Mere  demolition  is  straightforward.  Blowing  holes  in  the  crucial  containment 
building  is  not  even  necessary,  since  terrorists  can  simply  open  its  personnel 
airlock  doors.  (Schleimer  [1974:27n8]  notes  that  the  San  Onofre  information 
center  showed  every  hour  a  film  demonstrating  how  these  doors  work.)  Mindful 
of  the  near-miss  at  Browns  Ferry,  a  low-technology  saboteur  with  an  experimen¬ 
tal  frame  of  mind  might  want  to  see  what  arson  in  the  cable-spreading  room 
would  do.  Alternatively,  depending  on  the  occupiers'  technical  knowledge,  con¬ 
trol  systems  might  be  disabled,  bypassed,  or  reversed  so  as  to  make  the  plant 
destroy  itself.  Both  normal  and  emergency  coolant  could  be  removed  or  stagna¬ 
ted.  In  some  circumstances,  large  overpower  transients  might  be  achievable, 
especially  with  the  help  of  insiders.  The  occupiers  could  use,  alter,  or  dis¬ 
able  all  the  electrical  systems,  controls,  cables,  valves,  pumps,  pipes,  etc. 
virtually  at  will.  Even  major  components  are  highly  vulnerable  to  commercially 
available  shaped  charges,  to  thermic  rods  ("burn  bars"),  and  to  thermal  shock. 

Once  sabotage  had  begun,  repairs  and  countermeasures  could  rapidly  become 
impossible  even  if  the  plant's  operators  quickly  regained  control  of  the  site. 
Key  parts  of  the  plant  could  by  then  already  be  filled  with  steam,  water, 
noxious  gases,  or  high  levels  of  radi oact ivi ty .  It  could  be  impossible  even  to 
assess  damage.  Access  to  the  inside  or  outside  of  the  plant  could  readily  be 
interdicted  by  radioactive  releases,  chemical  poisons,  or  conventional  muni¬ 
tions  wielded  by  defenders  from  their  concrete  fortress — which  their  adversar¬ 
ies  would  hardly  want  to  damage.  Those  adversaries  would  have  to  include  and 
coordtiate  counterinsurgency  forces,  health-physics  teams,  and  reactor  engin¬ 
eers.  Further,  though  one  can  doubtless  assume  considerable  ingenuity  and 
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courage  on  the  part  of  the  forces  of  law  and  order,  the  history  of  major 
nuclear  accidents  suggests  that  one  can  also  expect  a  full  measure  of  confus¬ 
ion,  error,  foolishness,  and  possibly  panic.  Panic  would  almost  certainly 
ensue  in  downwind  areas,  probably  leading  to  considerable  loss  of  life  and 
property  and  hindering  the  arrival  of  backup  teams.  And  of  course  if  a  melt¬ 
down  did  occur,  then  events  onsite  and  releases  offsite  would,  by  general  con¬ 
sensus,  be  uncontrollable  and  unstoppable  in  principle,  owing  to  extreme  radia¬ 
tion  fields  and  the  formidable  temperatures,  masses,  and  chemical  properties  of 
the  materials  involved.  Major  psychological,  political,  and  economic  trauma  on 
a  national  or  world  scale  would  be  inevitable.  Civil  liberties  and  indeed 
civil  (as  opposed  to  martial)  law  would  probably,  as  in  a  nuclear  bomb  threat, 
be  among  the  early  casualties  [Blair  &  Brewer  1977). 

Any  consideration  of  potential  releases  of  radioactive  material  by 
sabotage  or  war  must  look  at  the  whole  nuclear  fuel  cycle,  not  just  reactors. 
One  modest  but  ubiquitous  source,  passing  through  the  midst  of  our  largest 
cities,  is  casks  carrying  spent  reactor  fuel.  A  single  3-element  shipment, 
after  150  days'  cooling,  still  contains  several  megacuries  [ Finley  etal. 
1980:103],  including  0.52  MCi  of  radiocesium  (134,137qs) — a  biologically 
active  nuclide  slightly  longer-lived  than  strontium-90  and  even  more  important 
from  the  standpoint  of  land  contaminat ion,  since,  unlike  strontium-90,  it  emits 
penetrating  hard  gamma  rays.  A  highly  unlikely  accidental  dispersal  of  a  much 
smaller  spent-fuel  shipment,  totalling  only  0.2  MCi,  in  New  York  City  is  calcu¬ 
lated  :65— 66]  to  cause  $2  billion  in  land  denial  by  contamination.  (This 

is  not  a  worst  case.  Dispersal  of  10  kg  of  plutonium  oxide,  of  which  only  5% 
is  assumed  to  become  airborne,  causes  the  same  contamination  damage  plus  over 
2000  deaths.  Dispersal  of  a  144-Ci  polonium-210  source  causes  scores  of  deaths 
and  $9  billion  in  contamination.  All  these  are  shipped  through  cities  too.) 

A  far  larger  source  term  is  the  inventory  of  spent  fuel  in  storage  pools, 
currently  at  reactors  but  perhaps  in  the  future  also  at  Away-From-Reactor  (AFR) 
centralized  pools  [ Dinneen  et  al .  1980).  Pools  at  reactors  are  often  badly 
protected;  many  are  above  grade;  and  the  fuel,  especially  in  its  first  few 
months  of  storage,  may  require  active  cooling  to  keep  it  from  melting.  And  an 
even  more  concentrated  source  of  long-lived  contaminants,  notably  ^Sr  and 
137cs>  is  tanks  containing  high-level  reprocessing  wastes — the  source  of 
two-thirds  of  the  release  hazard  calculated  by  Chester  &  Chester  [1976:337). 

Such  tanks  are  essential  at  reprocessing  plants  for  cooling  before  any  solidi¬ 
fication  of  high-level  wastes,  and  are  currently  holding  large  inventories  at 
several  U.S.  sites  (West  Valley  NY,  Hanford  WA,  Savannah  River  GA,  and  Idaho 
Falls  ID).  The  inventories  of  long-lived  isotopes  at  several  sites  are  in  the 
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GCi  (billions  of  curies)  range — enough,  if  a  substantial  fraction  is  dispersed, 
make  a  subcontinental  area  uninhabitable  for  several  centuries.  A  Barnwell¬ 
sized  (1500  T/y,  or  about  50-reactor)  reprocessing  plant,  after  five  years' 
operation,  stores  nearly  5  GCi  of  the  especially  hazardous  nuclides  zirconium- 
95,  niobium-95,  ruthenium-103  and  -106,  and  cesium-134  and  -137,  plus  0.8  GCi 
of  stront  •''jm-90.  Simple  plume  calculations  suggest  that  a  1%  release  from  this 
inventory  with  rainout  from  the  plume  could  contaminate  tens  of  thousands  of 
square  miles  with  persistent  radiation  of  tens  of  rem  per  year. 

To  make  such  a  release  easier,  the  reprocessing  plant  itself,  like  a 
reactor,  provides  substantial  internal  energies  [Gorleben  International  Review 
1979: Ch . 3 ] :  large  amounts  of  flammable  solvents,  ton  inventories  of  fissionable 
materials  that  must  be  carefully  protected  from  accidental  criticality,  hot 
reactive  acids,  thermally  and  radi oact i vely  hot  spent  fuel  and  wastes,  and  such 
possible  accident  initiators  as  a  product  of  solvent  radiolysis  known  as  "red 
oil,"  which  is  not  well  characterized  but  is  empirically  known  to  be  an  easily 
detonated  high  explosive.  It  is  also  noteworthy  that  such  a  plant  separates 
annually  in  pure,  readily  handled  form  of  the  order  of  10-15  tons,  thousands  of 
bombs'  worth,  of  plutonium;  in  five  years  the  plant  separates  more  fissile 
material  than  is  present  in  the  entire  U.S.  nuclear  arsenal,  accountable  with  a 
precision  unlikely  to  be  much  better  than  1% .  A  saboteur  with  access  to 
plutonium-dioxide  loading  or  storage  areas  could  assemble  in  a  few  minutes, 
using  other  materials  already  present  in  the  plant,  a  crude  nuclear  bomb  with 
a  yield  of  order  0.01-0.5  kT — more  than  sufficient  to  disperse  virtually  the 
whole  plutonium  inventory  and  probably  a  good  deal  of  the  fission-product 
inventory  too.  (No  reprocessing-plant  security  plan  envisages  this  method.) 

Accidents  at  the  Savannah  River  reprocessing  plant  have  already  released 
153  Ci  of  radioiodine  (about  ten  times  the  Three  Mile  Island  release)  in  five 
days  [Marter  1963]  and  479  kCi  of  tritium  in  one  day  [South  Carolina  Department 
of  Health  &  Environmental  Control  1974],  but  these  releases,  however  signifi¬ 
cant  [Alvarez  1980],  are  trivial  compared  with  what  even  a  modestly  serious 
accident  could  do  [Gorleben  International  Review  1979;  Hatzfeldt  et  al .  1979: 
78-98].  Such  an  accident  may  have  been  narrowly  averted  at  the  Cap de  la  Hague 
reprocessing  plant  in  France  on  !5  April  1980  when  a  supposedly  impossible 
total  electrical  failure  briefly  disabled  vital  cooling  and  safety  equipment. 
The  potential  was  also  obliquely  illustrated  by  two  U.S.  accidents  in  pluton¬ 
ium-handling  plants.  In  the  first,  Gulf  United  Nuclear's  Plutonium  Facility,  a 

mixed-oxide  fuel  fabrication  plant  at  West  Pawling,  New  York,  suffered  on  21 
December  1972  a  fire  and  two  explosions  of  unspecified  origin;  these  scattered 
an  undetermined  amount  of  plutonium  around  the  facility,  which  was  then  perma- 
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nently  closed  [Cochran  &  Speth  1974:10-17],  In  the  second,  the  Rocky  Flats 
plutonium  weapon-component  plant  15  miles  from  Denver  suffered  on  11  May  1969  a 
fire  that  appears  to  have  been  the  costliest  industrial  accident  in  U.S.  histo¬ 
ry,  General  Giller,  then  USAEC  Director  of  Military  Applications,  testified  in 
subcommittee  hearings  [Committee  on  Appropriations  1970]  that  the  fire  was  "a 
near  catastrophe"  and  that  "hundreds  of  square  miles"  could  have  been  contami¬ 
nated  if  the  fire  had  burned  through  the  roof.  "If  the  fire  had  been  a  little 
bigger,"  he  said,  "it  is  questionable  whether  it  could  have  been  contained." 

These  incidents  raise  the  disturbing  question — generic  to  nuclear  plants — 
of  "loss-of-supervision"  scenarios  [Gorleben  International  Review  1979:Ch,3] 
whereby  a  serious  release  sufficiently  contaminates  the  plant  and  its  environs 
that  it  can  no  longer  be  properly  maintained  to  fix  the  damage  or  even  to  pre¬ 
vent  further  deterioration.  Experience  at  the  Seveso  chemical  plant  in  Italy 
suggests  this  is  far  from  idle  speculation.  It  was  not  far  from  happening  when 
the  Browns  Ferry  control  room  filled  with  acrid  smoke  in  1975  [Comey  1975]  ,  or 
when  a  storage  tank  two  miles  from  the  Fort  Calhoun,  Nebraska  nuclear  plant 
spilled  150  tons  of  anhydrous  amnonia  in  November  1970,  forming  a  35-foot-thick 
layer  of  ammonia  that  covered  some  1000  acres  [Pollard  1979:26]  (nuclear  plants 
do  not  always  have  enough  breathing  apparatus  for  everyone).  Chester  [1976] 
says  that  sabotage  of  the  cooling  system  on  a  high-level  waste  tank  would  lead 
to  boiloff  of  the  water  and  release  of  fission  products,  but  this  "would  take 
weeks  or  months,  allowing  ample  time  for  detection  and  repair."  What  if  the 
sabotage  has  already  released  so  much  that  nobody  can  do  the  repairs?  [Gorleben 
International  Review  1979:Ch.3]  In  1977,  workers  at  the  Windscale  reprocessing 
plant  in  England  went  on  a  6-week  strike,  and  a  cladding  fire  was  feared  when 
they  would  not  allow  liquid-nitrogen  shipments  to  cross  picket  lines.  Eventual¬ 
ly  the  [Labour]  energy  minister  had  to  threaten  to  call  in  the  Army  [AP  1977]. 

The  loss  of  supervision  could  be  caused  by  violence,  not  contamination: 
as  noted  above,  the  operators  could  be  dead  or  incapacitated.  Carl-Fr iedrich 
von  WeizsHcker  recalls  a  colloquy  in  which  Norman  Rasmussen  was  insisting 
that  the  operators  would  always  stay  at  the  plant  to  keep  it  safe:  they  must 
because  the  regulations  said  so.  Von  WeizsUcker  persisted,  "What  if  they 
don't?  What  if  the  reactor  is  in  Beirut,  the  operators  are  Christians,  and  the 
Syrians  are  coming?"  Whereupon  a  third  person  remarked,  "I've  learned  more 
about  reactor  safety  in  the  past  five  minutes  than  in  the  previous  ten  years." 

Possible  envelopment  by  an  LNG  or  LPG  fireball  has  already  been  mentioned 
as  a  possible  event  that  could  endanger  a  nuclear  facility  and  disable  its 
operators.  Another  is  airplane  crashes.  On  25  August  1972,  a  light  plane  lost 


119 


in  dense  fog  crashed  into  the  Millstone  (Connecticut)  reactor  complex,  disab¬ 
ling  the  27 .6-kV  feeder  for  the  transformer  operating  shutdown  systems  and  cut¬ 
ting  off-site  telephones  for  three  hours.  (The  plant  did  not  reduce  power.) 
[Pollard  1979:39]  The  Big  Rock  Point  reactor  in  Michigan  was  apparently  such  a 
good  landmark  that  Air  Force  crews  used  it  for  practice  bombing  runs.  On  28 
May  1974,  the  Prairie  Island  reactor  was  repeatedly  overflown  at  low  altitude 
by  a  light  plane  piloted  by  a  known  criminal  who  appeared  to  be  photographing 
it;  subsequent  FBI  investigations  "did  not  reveal  any  malevolent  intention  or 
violation  of  the  law."  [Smith  1978:Encl .2:App.J  #10]  On  3  September  1975,  an 
Air  Force  B-52  carrying  no  weapons  exploded  in  flight  and  crashed  about  20 
miles  from  the  Savannah  River  reprocessing  plant  [Washington  Post  1975].  On  10 
November  1972,  three  men  hijacked  a  Southern  Airways  commercial  flight  to 
Canada,  made  the  pilot  circle  over  the  Oak  Ridge  complex,  threatened  to  crash 
the  plane  into  it  (reports  vary  as  between  the  Oak  Ridge  Research  Reactor  and 
tne  Y-12  plant),  collected  a  reported  $2  million  ransom,  and  landed  in  Cuba 
[Burnham  1975:124]. 

In  view  of  this  history,  it  is  disturbing  that  most  plants  are  designed  to 
withstand  a  crash  only  of  a  fairly  small  aircraft.  Wall  [1974],  for  example, 
offers  an  analysis  based  on  a  1968  census  of  the  civil  aviation  fleet,  before 
widebody  jets,  and  considers  the  impact  only  of  the  engines,  nor  of  the  air¬ 
frame.  Likewise,  the  official  safety  report  for  the  proposed  Gorleben  repro¬ 
cessing  plant  in  the  Federal  Republic  of  Germany  considered  only  crashes  by 
Phantom  jets  at  215  m/s,  whereas  a  Boeing  747  at  200  m/s  would  produce  a  peak 
impact  nearly  six  times  as  big  and  lasting  more  than  twice  as  long  [Hatzfeldt 
et  al .  1979:92].  By  a  lucky  irony,  the  double  containment  strength  that  enab¬ 
led  the  Three  Mile  Island  containment  shell  to  withstand  the  hydrogen  explosion 
was  designed  in  because  a  commercial  flight  lane  for  low-level  approaches  to 
the  Harrisburg  airport  passes  essentially  over  the  plant;  but  it  is  unlikely 
that  most  reactors  or  other  nuclear  facilities  are  really  equipped  to  handle  a 
crash  by  well-laden  widebody  aircraft.  The  tendency  of  the  jet  fuel  to  cause  an 
after-crash  fire  about  half  the  time  would  also  complicate  shutdown  and  repair 
efforts  in  the  stricken  plant. 

Our  selection  of  examples  of  potential  sabotage  has  been  illustrative,  not 
comprehensive.  Many  other  points  of  vulnerability  can  be  found  in  the  nuclear 
fuel  cycle.  For  example,  heavy-water  plants,  operating  at  Savannah  River  and 
in  Canada,  have  enormous  inventories  of  hydrogen  sulfide,  whose  toxicity  limit 

's  550  ppm  or  750  mg/rn-^.  Some  official  calculations  suggest  that  a  major 
release  of  H2S  could  be  about  as  hazardous  as  a  modest  reactor  accident; 
and  the  plants  have  far  less  protection  than  a  reactor.  We  have  also  not 
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sought  here  to  consider  all  possible  methods  of  sabotage,  even  in  general 
terms.  Many  nuclear  facilities,  for  example,  are  highly  vulnerable  to  insider 
reprogramming  or  disabling  of  their  control  computers,  resetting  of  their 
instrument  trip  points,  biasing  of  their  calibration  standards,  etc.  It  is 
also  possible  to  attack  a  plant  by  standoff  in  time  rather  than  in  space.  Now 
that  digital  watches  with  long-lived,  low-drain  batteries  are  widely  available, 
along  with  sophisticated  and  highly  reliable  electronics  of  all  kinds,  it  is 
feasible  to  conceal  a  conventional  chemical  bomb  (or  at  least  to  say  one  has 
done  so)  in  a  reactor  under  construction.  One  extortionist  recently  claimed  he 
had  put  a  bomb  in  a  concrete  wall  being  poured  at  a  reactor,  and  it  proved 
very  difficult  to  find  out  whether  the  claim  was  true.  On  occasion,  foreign 
objects  considerably  more  obtrusive  than  a  lump  inside  a  concrete  wall  have 
escaped  detection  for  a  surprising  time:  on  8  May  1972,  for  example,  Common¬ 
wealth  Edison  reported  to  the  AEC  that  they  had  retrieved  a  complete  Heliarc® 
welding  rig,  complete  with  7.5-m  cables  and  hose,  from  inside  a  malfunctioning 
jet  pump.  Substantial  foreign  bodies  have  even  been  retrieved  from  reactor 
cores.  The  technical  and  operational  sophistication  of  the  extortionist's  bomb 
that  caused  $3  million  damage  to  Harvey's  Resort  hotel-casino  in  Stateline, 
Nevada  on  26  August  1980  (giving  rise  to  hundreds  of  imitative  threats  over  the 
following  year  [Los  Angeles  Times  1981 f ] )  suggests  that  this  sort  of  threat, 
skillfully  done,  could  shut  down  a  lot  of  nuclear  capacity  virtually  at  will. 

3.4.4.  Consequences  of  major  releases. 

Having  reviewed  the  kinds  of  resources  and  techniques  that  can  be  devoted 
to  achieving  a  major  release  of  radioactivity  from  nuclear  facilities,  we  must 
now  consider  the  possible  consequences — radiological,  social,  and  economic. 
Unfortunately,  most  of  the  literature  on  major  nuclear  accidents  may  understate 
the  possible  results  of  successful  sabotage.  According  to  the  General  Accoun¬ 
ting  Office  [Comptroller  General  of  the  U.S.  1977:6],  a  classified  Sa.idia  as¬ 
sessment  of  reactor  sabotage,  for  example,  found  that  the  consequences  could 
not  exceed  the  maximum  calculated  in  the  Rasmussen  Report  [NRC  1973]  for  a 
major  accident — 3300  prompt  deaths,  1500  delayed  cancer  deaths  per  year  for 
10-40  years,  and  $14  billion  in  property  damage.  Yet  the  Rasmussen  Report  did 
not  present  those  figures  as  the  results  of  a  worst  possible  accident:  worse 
ones  were  physically  possible  but  were  assigned  a  low  probability  and  not 
considered  [Kendall  et  al .  1977:61f] .  Further,  a  saboteur  would  be  free  to 
select  all-worst-case  conditions — near-urban  reactor,  mature  core,  meteorologi¬ 
cal  inversion,  wind  blowing  toward  the  city — and  could  disable  mitigating 
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systems  (such  as  containment  sprays)  and  breach  the  containment.  Nonetheless, 
most  commentators  have  uncritically  accepted  contentions  by  the  Sandia  group 
(whose  supporting  analysis,  if  any,  is  unavailable  to  the  public),  in  the 
Rasmussen  Report  itself  (which  provided  none — it  nowhere  considered  sabotage), 
and  elsewhere  that  the  consequences  of  sabotage  could  not  exceed  those  of  a 
serious  accident.  That  finding  has  never  been  justified  in  open  literature  and 
"is  very  likely  untrue"  [id.:61].  For  lack  of  better  data,  however,  we  shall 
take  the  consequences  of  accidents  as  indicative  of  those  of  successful  sabo¬ 
tage;  and  it  is  common  ground  that  both  could  be  graver  than  any  peacetime 
disaster,  and  perhaps  any  wartime  disaster,  in  recent  world  history. 

A  recent  review  [Beyea  1980]  of  the  long-distance  consequences  of  major 
accidental  releases  from  a  power  reactor — assumed  for  analytic  specificity  to 
be  Three  Mile  Island — finds  that  delayed  effects,  especially  thyroid  damage  and 
land  contamination,  "can  be  a  concern  more  than  one  hundred  miles  downwind  from 
an  accident  and  for  many  decades"  [:4],  i.e.  far  beyond  "the  distances  for 
which  emergency  planning  is  required  by  current  Federal  guidelines"  (  : 2 ]  .  Such 
large  releases  can  arise  in  accidents  only  if  the  containment  building  fails 
or  is  bypassed,  but  this  can  occur  with  or  without  a  full  core  meltdown,  due  to 
isolation  failure,  overpressurization  after  containment  spray  failure,  or  per¬ 
haps  a  hydrogen  explosion  [  : 6 ]  .  (The  hydrogen  explosion  during  the  TM1  acci¬ 
dent  may  have  been  sufficient  to  breach  smaller  or  weaker  containment  buildings 
in  use  at  many  other  reactors  [Jd^.].)  A  core  meltdown  would  add  the  possibili¬ 
ty  of  violent  steam  explosions,  and  would  release  enough  hydrogen  or  carbon 
dioxide  or  both  to  make  the  probability  of  containment  rupture  about  0.2 
(according  to  the  Rasmussen  Report)  for  large  containments  and  nearly  1.0  for 
small  ones,  such  as  those  on  nearly  all  boiling-water  reactors  [  : 6—  7 ] .  Disper¬ 
sion  calculations  show  {  :11— 13]  that  depending  on  wind  direction,  de layed 
cancer  deaths  alone,  in  the  75  years  following  the  release,  beyond  50  miles 
from  the  reactor  (ignoring  all  those  closer  to  it),  would  probably  range  from 
about  0  to  about  60,000  under  typical  meteorological  conditions,  assuming  the 
reactor  core  was  mature,  i.e.  to  be  refueled  shortly.  The  beyond-50-mi les  zone 
would  also  suffer  a  similar  number  of  genetic  defects,  from  0  to  about  450,000 
thyroid  nodules,  and  land  contamination  of  from  0  to  about  5300  square  miles 
(with  short-term  farming  restrictions  on  up  to  175,000  square  miles).  Most  of 
this  population  exposure  would  be  at  doses  of  order  tens  of  rem  or  less.  Prompt 
deaths,  from  whole-body  exposure  over  150  rem,  would  occur  only  within  a  few 
tens  of  miles  of  the  reactor.  This  region,  which  in  some  cases  (e.g.  Indian 
Point,  Zion)  includes  major  cities,  is  excluded  from  Beyea’s  calculations  but 
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considered  in  such  studies  as  the  Rasmussen  Report  [NRC  1975]  ,  whose  “maximum" 
consequences  are  noted  above. 

Another  recent  analysis  [Fetter  &  Tsipis  1980,1981]  has  compared  the  ra¬ 
dioactive  releases  that  might  be  caused  by  a  major  reactor  accident,  a  nuclear 

explosion,  and  the  former  caused  by  the  latter.  The  radioactivity  from  a  one- 

megaton  bomb  explosion  is  some  40  TCi  (4  *  10^  curies)  at  detonation, 
compared  with  an  equilibrium  core  activity  of  over  15  GCi — over  2000  times 
smaller — for  a  1-GWe  light-water  reactor.  But  the  activity  of  the  bomb  debris 

decays  far  faster,  so  that  after  the  first  hour,  the  bomb  activity  is  only  one 

and  a  half  orders  of  magnitude  greater  than  the  reactor's;  after  a  day,  the 
same;  after  a  month,  an  order  of  magnitude  less  (i.e.  of  the  same  order  as  a 

10%  release  from  the  reactor  core  to  the  environment);  after  a  year,  10  times 

less;  after  five  years,  100  times  less;  after  25  years,  1000  times  less  [ : 20— 

22].  Accordingly,  a  bomb  that  vaporizes  a  reactor  core  will  greatly  increase 

(by  tenfold  after  one  year)  the  amount  of  interdicted  land.  Assuming  a  ceiling 
dose  limit  of  2  rem/y  to  resettlers,  the  area  seriously  contaminated  for  centur¬ 
ies  would  be  hundreds  of  square  miles  (a  total  of  about  400,000  square-mile- 
years),  or  about  forty  times  that  caused  by  a  1-megaton  surface  burst.  As  we 
shall  note  below,  similar  consequences  could  arise  from  a  bomb  "even  of  rela¬ 
tively  small  yield,  such  as  a  crude  terrorist  nuclear  device"  [1980:29],  That 
could  indeed  be  worse,  since  lower  yield  would  not  carry  the  debris  so  high, 
and  the  reactor  fallout  would  therefore  be  sooner  and  more  intense  than  if 
spread  over  a  large  stratospheric  volume  by  the  strong  updrafts  of  a  high-yield 
exp l os i on . 

Thus  a  nuclear-capable  terrorist  or  a  "determined  or  desperate  combatant 
[in  Europe]  can,  by  waiting  for  the  proper  weather  conditions,  devastate  a 
substantial  fraction  of  the  industrial  capacity  of  an  opponent  with  a  single 
nuclear  weapon  aimed  on  a  reactor."  [1980:29]  The  activity  released  would 
exceed,  perhaps  by  one  or  two  orders  of  magnitude,  the  release  in  a  reactor 
accident.  (Beyea  [1980:E-4]  assumes  a  maximum  release  of  502  of  core  cesium 
and  rubidium,  70%  of  iodine,  90%  of  noble  gases,  30%  of  tellurium  and  antimony, 
6%  of  barium  and  strontium,  2%  of  refractory  metals,  and  0.4%  of  lanthanides 
and  actinides.  He  notes,  however  [:8J,  that  the  actual  TMI  accident  released 
about  as  much  activity  from  the  fuel  elements  as  had  been  expected  in  a  full 
meltdown  for  release  of  volatile  elements  alone,  such  as  cesium  and  iodine. 

Even  a  small  bomb  could  cause  essentially  100%  release  of  the  entire  core.) 

Holdren  [1981]  adds  an  important  footnote  to  Fetter  and  Tsipis' s  calcula¬ 
tions:  if,  as  Beyea  has  done,  they  also  consider  the  long-term,  long-range  dose 
commitments,  then  a  reactor  accident  alone,  with  no  bomb  detonation  nearby,  is 


"within  a  factor  of  two  of  the  [one-megaton  surf ace-burst ]  bomb  at  distances  out 
to  200  km,  closing  in  beyond  that  distance  and  delivering  higher  total  doses 
than  the  bomb  beyond  about  900  km."  In  an  even  more  direct  comparison  [:3], 
Beyea's  worst-case  accident  gives  a  dose  commitment  of  about  120  million 
person-rem,  compared  to  Rasmussen's  1000  million;  whereas  OTA  [1979:13)  implies 
10-100  million  person-rem  for  a  1-MT  airburst  and  250-3000  million  person-rem 
from  a  1-MT  groundburst.  Thus,  contrary  to  the  Fetter  and  Tsipis  conclusion 
[1981),  which  concentrates  on  near-term,  short-range  effects,  even  a  1 — hTT 
groundburst  is  not  necessarily  more  destructive  radiologically  than  a  severe 
reactor  accident.  But  conversely  [Holdren  1981:4),  "the  possibility  of  mali¬ 
cious  as  well  as  accidental  destruction  of  a  reactor  core"  returns  again  to 
"the  unfortunate  links  between  nuclear  power  and  expanded  access  to  the  raw 
materials  of  nuclear  weaponry ... .For  the  staggering  radiological  consequences 
of  destruction  of  a  nuclear  reactor  by  a  nuclear  weapon — the  third  case  consid¬ 
ered  by  Fetter  and  Tsipis — put  the  radiologic  damage  potential  of  a  fail  sized 
nuclear  arsenal  into  the  hands  of  any  nation  or  terrorist  group  with  a  single, 
10-kilotor.  bomb."  (As  noted  below,  a  smaller  yield  would  also  suffice.) 

The  consequences  of  a  single  act  of  nuclear  sabotage  can  be  comparable, 
then,  to  those  of  nuclear  war.  Remote  siting,  undergrounding,  containment  vent¬ 
ing  filters,  evacuation,  thyroid  blocking,  sheltering,  air  filtration,  and 
other  measures  meant  to  mitigate  the  effects  of  reactor  accidents  would  be 
grossly  unequal  to  the  task.  The  Nuclear  Regulatory  Commission  does  not  seem 
much  interested  even  in  these  modest  measures  [Beyea  1980),  and  the  nuclear 
industry  seems  to  feel  that  mitigation  methods  are  unnecessary  or  embarrassing. 
(For  example,  the  Senior  Vice  President  of  Philadelphia  Electric  Company  tes¬ 
tified  on  27  May  1980  that  "Evacuation  plans  are  just  the  window  dressing  and 
the  final  back-up  plan";  that  a  1.7-mile  Low  Population  Zone  for  evacuation 
planning  around  Limerick  is  "more  than  adequate";  and  that  "Emergencies  that 
will  require  evacuation  will  not  occur."  [Kostmayer  &  Markey  1980))  This  lowers 
still  further  the  threshold  for  sabotage  that  can  be  disastrously  effective. 

So  far  we  have  considered  consequences  only  at  a  crude  level  death,  dis¬ 
ease,  land  denial.  But  at  a  societal  level,  psychological  impacts  may  in  fact 
be  more  important  [e.g.  Lifton  1967;  Del  Tredici  1980;  Perelman  1979).  Whether 
reactor  sabotage  is  technically  successful  or  not  may  be  less  important  than 
whether  people  think  it  may  succeed.  The  psychological  impact  of  a  potential 
release  was  strikingly  confirmed  even  before  Three  Mile  Island  when  a  Wai  of- 
the-Wor Ids- type  radio  drama  broadcast  in  Denmark  on  13  November  1973  described 
a  supposed  1982  meltdown  in  the  BarsebHck  reactor  in  Sweden  (visible  across 
the  narrow  straits  from  Copenhagen),  allegedly  sending  an  invisible  but  deadly 
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plume  Cowards  the  Danish  capital.  Residents  panicked;  some  began  to  evacuate; 
some  thought  their  loved  ones  dead;  and  it  took  hours  of  repeated  assurances 
that  it  was  all  fictitious  before  people  got  the  message  [Nuclear  Engineering 
Internat  ional  1974] . 

Since  "large  numbers  of  people  in  many  countries  have  become  acutely 
concerned"  [Ramberg  1978:4;  Farhar  etal.  1980]  about  nuclear  risks,  it  is 
likely  that  a  major  nuclear  release  will  lead  to  irresistible  demands  for  the 
shutdown  of  operating  nuclear  power  plants  and,  perhaps,  of  military  nuclear 
plants.  In  view  of  deep-seated  public  attitudes  and  the  many  ways  which  a 
democracy  offers  for  expressing  them,  this  is  not  a  trivial  dimension  of 
vulnerability:  it  means  that  a  sizeable  accident  may  lead  to  the  loss  not  of 
one  or  two  GWe  but  of  50+  GWe  now  and  of  any  prospect  of  more  later,  to  say 
nothing  of  political  fallout  in  other  countries.  Conversely,  Jenkins  [1975:7] 
notes  that  public  attitudes  may  be  the  most  important  motivation  for  terrorists 
to  acquire  nuclear  bombs  or  attack  nuclear  plants:  "...the  primary  attraction 
to  terrorists  in  going  nuclear  is  not  that  nuclear  weapons  would  enable  terror¬ 
ists  to  cause  mass  casualties,  but  rather  that  almost  any  terrorist  action 
associated  with  the  words  'atomic'  or  'nuclear'  would  automatically  generate 
fear  in  the  minds  of  the  public." 

The  technical  and  economic  impact  of  the  protracted  disabling  of  any  part 
of  the  nuclear  fuel  cycle  would  tend  to  be  heightened  by  that  cycle's  intricate 
interdependence.  It  entails  not  just  one  but  many  complex  operations  whose 
logistical  coordination  has  remained  an  elusive  goal  for  several  decades.  One 
failure  or  bottleneck  can  have  unexpected  side-effects  throughout  the  rest  of 
the  system.  Just  as  reactors  can  become  constipated  if  there  is  no  place  to 
store  their  spent  fuel  (a  problem  that  has  lately  required  the  hasty  "densifi- 
cation"  of  many  storage  pools),  or  i f  there  are  not  enough  special  casks  in 
which  to  ship  it  elsewhere,  so  a  reprocessing  plant  can  become  constipated  if 
spent  fuel  arrives  faster  than  technical  breakdowns  allow  it  to  be  handled. 

This  is  currently  the  cause  of  a  serious  and  worsening  problem  at  both  the 
British  and  French  plants  for  reprocessing  fuel  from  graphite-moderated  gas- 
cooled  reactors.  The  magnesium-alloy  cladding  of  that  fuel  corrodes  in  a 
matter  of  years  when  stored  (as  it  normally  is)  in  water.  Persistent  problems 
at  both  reprocessing  plants  have  led  to  an  increasing  backlog  of  rotting  fuel 
in  storage  pools.  This  increases  operational  problems  and  occupational  haz¬ 
ards,  leading  to  still  more  breakdowns.  A  Cap  de  la  Hague,  this  cascading  slow¬ 
down  has  diverted  much  of  the  capacity  meant  for  handling  oxide  (LWR)  fuel, 
incidentally  so  reducing  the  plutonium  output  that  France  must  buy  British 
plutonium  to  fuel  the  Super-Phenix  fast  reactor. 
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Should  fuel  cycles  ever  come  to  depend  on  reprocessing  (as  with  breeder 
reactors),  about  50  reactors  would  depend  for  their  fuel  on  timely  deliveries 
from  a  single  reprocessing  plant.  At  perhaps  $3-8  billion  each,  such  plants 
would  be  too  costly  to  back  up.  (The  several  fuel- fabr i cat i on  plants  might 
offer  a  similar  bottleneck.)  Such  fuel-cycle  dependencies  clearly  create  a 
remarkable  vulnerability:  a  single,  otherwise  minor  reprocessing  problem  could 
idle  some  $100+  billion  worth  of  breeders. 

Although  the  sheer  cost  of  replacing  a  major  nuclear  plant  (or  even 
cleaning  up  its  remains)  is  probably  less  of  an  incentive  to  sabotage  it  than 
resulting  releases,  costs  are  not  negligible.  The  extraordinary  capital  inten¬ 
sity  of  nuclear  plants  (new  ones  typically  will  cost  several  billion  dollars 
each)  does  represent  a  risk  to  large  blocks  of  invested  capital,  as  Three  Mile 
Island  investors  have  discovered.  Few  if  any  utilities  in  the  world  have 
enough  financial  safety  margin  to  absorb  such  a  risk,  and  as  Three  Mile  Island 
has  again  demonstrated,  institutional  preparedness  for  a  mul t i-bi 1 1 i on-dollar 
loss  is  also  woefully  inadequate.  America's  capital  structure  is  already  at 
risk  because  many  utilities  are  insolvent,  and  their  debt  and  equity — the 
largest  single  block  of  paper  assets  in  the  whole  economy — is  the  basis  of  many 
highly  leveraged  institutions.  (How  the  insolvency  arose  and  what  to  do  about 
it  are  explored  further  in  Appendix  A.)  Utility  finance,  and  hence  capital 
markets  generally,  are  currently  so  precarious — and  likely  to  remain  so  for 
many  years — that  another  major  loss  could  trigger  cascading  bankruptcies  on  a 
wholly  unmanageable  scale.  The  potential  economic  consequences  of  losing  a 
major  nuclear  asset  thus  go  well  beyond  a  particular  utility  or  its  ratepayers 
or  investors.  Further,  the  financial  community  already  perceives  substantial 
risk  associated  with  utility  investments  in  general  and  nuclear-power  invest¬ 
ments  in  particular  [Emshwiller  1980,1981;  Hershey  1981;  Bupp  1981;  O'Donnell 
1981;  Marshall  1981a;  Parisi  1981;  Shearson  Loeb  Rhoades  Inc.  1981:4-9].  What 
long-term  prospects  for  nuclear  finance  have  survived  Three  Mile  Island  would 
certainly  not  survive  a  major  episode  of  sabotage  anywhere  in  the  world. 

3.4.5.  The  added  risk  of  nuclear  bombs. 

The  foregoing  assessment  has  mentioned  only  in  passing  that  the  risks 
described  could  be  greatly  increased  by  the  direct  and  indirect  consequences  of 
nuclear  explosions,  even  of  low  yield  (kilotons  or  less).  Unfortunately,  the 
nuclear  enterprise,  both  civil  and  military,  increases  the  likelihood  that 
nuclear  bombs  will  become  more  widely  available.  Ignoring  for  simplicity  the 
complex  details  which  we  have  elsewhere  treated  and  documented  in  detail 
[Lovins  &  Lovins  1980],  this  linkage  has  three  main  causes: 
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1.  Every  form  of  every  fissionable  material  used  in  every  nuclear  fuel 
cycle  can  be  made,  either  directly  or  when  treated  with  apparatus  made  widely 
available  by  nuclear  power,  into  formidable  nuclear  bombs — at  least  in  the 
kiloton  range.  The  other  resources  needed  are  available  to  almost  any  govern¬ 
ment,  to  many  nongovernmental  groups,  and  to  some  able  individuals.  (Appendix 
B  is  a  technical  assessment  of  expected  explosive  yields  from  plutonium  as  a 
function  of  isotopic  composition,  chemical  form,  and  design  sophistication.) 
Power  reactors  are  themselves  a  peculiarly  convenient  type  cf  military  produc¬ 
tion  reactor,  providing  extremely  large  scale,  zero  political  cost,  and  almost 
no  marginal  economic  cost.  The  barriers  supposedly  posed  by  enrichment  and 
reprocessing  technology  are  not  insuperable;  even  the  conversion  of  one  fresh 
LWR  fuel  bundle  into  a  bomb's  worth  of  plutonium  may  be  possible  on  a  basement 
scale.  There  is  no  "technical  fix"  to  this  problem,  and  no  "political  fix" 
short  of  global  dictatorship.  There  is  no  prospect  of  adequate  protection  from 
any  present  or  foreseeable  means  of  monitoring,  accounting  for,  physically 
protecting,  and  preventing  governmental  diversion  of  fissionable  materials — 
provided  that  fission  (or  perhaps  fusion)  technologies  are  in  widespread  use. 
Thus  civil  denuclearization  is  a  necessary  condition  for  nonprol i ferat ion. 

2.  It  is  not  only  fissionable  materials  that  link  reactors  to  bombs.  Much 
of  the  equipment,  knowledge,  technical  skill,  and  organizational  structure 
essential  for  the  former  is  also  helpful  for  the  latter.  History  suggests  that 
this  connection  can  generate  its  own  momentum  through  the  evolution  of  techni¬ 
cal  and  commercial  lobbies.  These  can  become  so  powerful  and  self-contained 
that  they  become  a  government  unto  themselves,  evading  (as  in  the  1950s  British 
bomb  program)  or  overturning  (as  in  the  French)  established  political  controls. 

3.  Perhaps  the  most  important  link  is  that  nuclear  power  provides  an  in¬ 
nocent  "cover"  beneath  which  bomb  programs  can  be  readily  concealed,  and  an 
ambiguity  which  invites  latent  prol i ferators  to  sidle  up  to  the  nuclear  thres¬ 
hold  by  degrees.* 

♦Conversely,  in  a  world  without  nuclear  power,  the  materials,  skills,  and 
equipment  needed  to  make  bombs  by  any  known  method  would  no  longer  be  items  of 
commerce;  efforts  to  get  them  would  be  more  conspicuous;  and  being  caught 
trying  to  get  them  would  be  politically  far  costlier  to  both  customer  and 
supplier,  because  for  the  first  time  the  intention  would  be  unambiguously 
mi  1 i tary .  Thus  civil  denuclearization  is  a  largely  (though  not  wh-  ’ly)  suffi¬ 
cient  condition  for  nonproliferation.  There  are  also  intricate,  n.iprocal 
connections  between  vertical  proliferation — the  mul t i pi i cat  ion  and  refinement 
of  bombs  now  possessed  by  governments — and  horizontal  proliferation  to  addi¬ 
tional  parties.  Neither  of  these  problems  can  be  consistently  formulated  or 
successfully  addressed  alone.  These  issues,  and  the  problem  of  proliferation 
generally,  are  beyond  the  scope  of  this  study,  but  are  treated  elsewhere 
[Lovins  6  Lovins  1980] . 
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The  resources  needed  to  design  and  build  a  working  nuclear  bomb  are  highly 
variable.  As  shown  in  Appendix  B,  but  to  an  extent  greater  than  can  be  fully 
explained  there,  the  sophi st icat ion  of  design  and  construction  can  vary  enor¬ 
mously,  depending  on  the  ingenuity  and  resources  available.  Rule-of-thumb 
designs  capable  of  being  "thrown  together"  with  generous  safety  margins  can  be 
envisaged  and  might  enter  terrorist  folklore.  In  general,  official  assessments 
tend  to  assume  more  sophistication  than  is  actually  needed;  but  NRC's  operating 
assumption  [Gossick  1977]  is  that  "a  small  non-national  group  of  people"  could 
make  a  crude  bomb  if  they  had  "the  appropriate  technical  capabilities"  and  a 
formula  quantity  of  fissionable  material.  (That  is  equivalent  to  5  kg  of  highly 
enriched  uranium-235  (HEU),  similarly  reactive  amounts  of  medium-enriched 
235uf  2  kg  of  plutonium  of  any  isotopic  composition,  or  2  kg  of  ^33u. 

Some  other  usable  materials,  such  as  ^37fjpj  are  not  subject  to  safeguards.) 

The  NRC  wisely  does  not  give  safeguards  any  credit  for  the  fact  that  a  larger- 
than-formula  quantity  would  be  needed  in  crude  designs,  nor  for  "the  difficulty 
or  any  extended  length  of  time  involved  in  designing  and  fabricating"  a  bomb 
[id.].  (Taylor  [1973:182]  points  out  that  even  converting  uranium  or  plutonium 
nitrate  to  metal — an  optional  operation — is  no  more  risky  or  difficult  than 
converting  morphine  base  to  heroin,  an  operation  that  has  been  carried  on 
routinely  by  criminals  in  the  south  of  France  for  many  years.) 

Regardless  of  one's  view  about  the  resources  and  skills  required,  however, 
the  plain  fact  is  that  any  threat  of  a  clandestine  bomb  which  is  competently 
enough  framed  to  be  technically  credible  is  automatically  credible.  This  is 
because  the  skills  and  luck  of  those  claiming  to  have  the  bomb  are  unknown,  and 
because  they  may  well  have  the  fissionable  material.  This  in  turn  is  inescap¬ 
able  because  the  cumulative  statistical  uncertainty  in  U.S.  inventories  of  bomb 
materials — the  margin  within  which  neither  presence  nor  absence  of  the  materi¬ 
als  in  their  proper  place  can  be  confirmed — is  about  20  tons,  i.e.  thousands  of 
bombs'  worth,  for  HEU  alone  [O'Toole  1977]  ,  plus  some  more  for  plutonium  and 
233u  (141  kg  for  Savannah  River  plutonium  alone  [Burnham  1980]).  It  is 
steadily  increasing.  (A  similar  situation  prevails  abroad,  and  bomb  materials 
can  be  smuggled  across  national  borders  as  easily  as  heroin.)  Perhaps  no  bomb 
material  has  been  stolen;  perhaps  the  Erwin  employees  who  checked  each  other 
for  theft  under  an  honor  system  [Subcommittee  on  Energy  &  the  Environment 
1977a: 38 ]  were  all  honorable;  perhaps  the  NRC  Office  of  Nuclear  Materials  and 
Safeguards  was  being  alarmist  in  proposing  to  revoke  the  Erwin  plant's  license 
(Burnham  1979b];  perhaps  it  is  pure  chance  that  as  of  January  1978,  eight  of 
the  previous  twelve  inventory  periods  at  Erwin  had  resulted  in  the  limit  of 
error  being  exceeded  (NRC  1978];  perhaps,  even  though  "a  knowledgeable  insider 
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could  quite  easily  have  made  off  with"  HEU  from  the  Apollo  plant  in  the  1960s 
(Subcommittee  on  Energy  &  the  Environment  1979:7),  nobody  bothered  to;  perhaps 
it  is  purely  coincidental  that  the  statistical  alarm-bells  in  U.S.  bomb-materi¬ 
als  accounting  have  been  ringing  at  least  a  third  of  the  time  (Marshall  1981b). 
But  nobody  can  give  an  assurance  that  matters  are  so  satisfactory.  Anyone  who 
claims  to  possess  bomb  material  and  seems  to  know  what  he  or  she  is  doing  is 
believeable.  This  consequence  of  the  nuclear  age  is  irreversible. 

The  coercive  power  of  nuclear  bombs  is  the  basis  of  their  use  by  govern¬ 
ments  possessing  them  as  a  principal  instrument  of  foreign  policy.  Might  this 
same  coercive  power  fall  into  other  hands?  Some  people,  apparently  meaning  to 
be  reassuring,  have  argued  that  terrorists  would  pass  up  nuclear  bombs  in  favor 
of  other  and  perhaps  simpler  weapons  of  mass  destruction,  such  as  chlorine 
tankers  (toxic  at  15  parts  per  million)  or  pathogenic  bacteria  (Kupperman  & 
Trent  1979:46).  These  have  in  fact  both  been  threatened  by  extortionists,  and 
it  is  true  that  anthrax  spores,  claimed  in  a  German  extortion  attempt  (id.), 
are  five  orders  of  magnitude  more  toxic  per  gram  than  nerve  gases  and  perhaps 
three  orders  of  magnitude  more  lethal  per  gram  than  fissile  material  in  crude 
bombs  [jd^.  :57):  their  lethality  could  indeed  "rival  the  effects  of  a  thermonu¬ 
clear  device"  [_i£.  : 46 ,65-68)  .  But  it  is  the  psychology,  not  the  technology,  of 
thmats  that  explains  why  nuclear  bomb  threats  have  in  fact  outnumbered  germ- 
warfare  threats  by  better  than  twenty  to  one.  (The  existence  of  one  vulnera¬ 
bility  in  society,  moreover,  is  not  an  argument  for  creating  yet  another, 
but  rather  for  seeking  to  reduce  all  of  them.) 

If  fissionable  materials  had  actually  been  made  into  an  illicit  bomb,  that 
fact  would  probably  be  highly  classified.  Between  October  1970  and  November 
1977  in  the  United  States,  however  [Bass  et  al.  1980:55],  there  were  49  threat 
messages  "in  which  adversaries  claimed  to  possess  nuclear  material  or  a  nuclear 
[explosive  or  dispersion)  device  and  threatened  to  wreak  severe  damage  with 
it."  Such  events  doubtless  continue;  the  press  reported  one,  for  example,  in 
January  1979.  Special  procedures,  evaluation  teams,  telephone  numbers,  etc. 
have  been  set  up  to  deal  with  these  threats,  both  at  a  Federal  level  and  in 
some  States  (notably  California).  At  least  four  threats  were  reportedly  deemed 
sufficiently  credible  to  evoke  a  high-level  response,  normally  including  an 
intensive  search  by  a  specially  instrumented  team  [Singer  &  Weir  1979).  So  far 
as  is  publicly  known,  all  the  threats  have  so  far  been  bluffs,  rather  than 
representing  actual  devices  which  failed,  or  which  worked  and  were  hushed  up. 
Again,  so  far  as  is  publicly  known,  all  the  threats  have  so  far  been  treated  as 
bluffs,  i.e.  called.  It  is,  however,  hypothetically  possible — there  would  be 
no  way  for  the  public  to  tell  —  that  our  government,  or  some  other  government, 


has  in  fact  capitulated  to  a  non-hoax  nuclear  threat  and  is  implementing,  in 
the  guise  of  normal  incremental  policy  shifts,  concessions  dictated  by  an 
extortionist.  The  degree  of  openness  and  public  trust  normally  associated  with 
governmental  affairs,  at  least  in  the  United  States,  makes  this  hypothesis  seem 
unlikely,  but  it  cannot  be  altogether  excluded;  and  certainly  there  is  a 
lingering  air  of  suspicion  about  apparent  efforts,  as  the  Comptroller  General 
of  the  U.S.  saw  them,  to  block  a  full  investigation  of  alleged  thefts  of  bomb 
material  in  the  mid-1960s  [Burnham  1979a], 

What  could  a  terrorist  who  actually  possessed  a  nuclear  bomb  do  with  it? 
Aside  from  obvious  high-leverage  targets* of  a  non-nuclear  character  (national 
monuments,  centers  of  commerce,  occasions  on  which  many  government  officials 
are  assembled,  sports  stadia,  dams,  refinery  complexes,  etc.),  nuclear 
facilities  offer  a  peculiarly  attractive  target  because  they  can  amplify  the 
radiological  effects  of  even  a  small,  crude  bomb  by  three  to  five  orders  of 
magnitude.  Consider,  for  example,  the  effects  of  exploding  a  bomb  near  a  power 
reactor.  Chester  &  Chester  [1976:329]  state  that  cooling  towers,  without  which 
the  plant  cannot  operate,  suffer  heavy  internal  damage  at  about  2  psi  overpres¬ 
sure,  and  will  collapse  at  about  3  psi.  At  about  12  psi,  "damage  to  the  con¬ 
trol  room,  auxiliary  equipment,  transformers,  and  water  tanks  will  be  so  severe 
that  it  will  be  very  unlikely  that  even  an  uninjured  emergency  crew  could  pre¬ 
vent  destruction  of  the  core."  The  containment  shell  (for  ice-condensing  PWRs) 
will  be  "badly  damaged"  and  the  primary  coolant  loop  will  probably  suffer  minor 
damage  at  about  30  psi,  causing  a  major  release  within  hours.  The  pressure 
vessel  will  rupture,  releasing  at  least  volatile  fission  products  in  minutes, 
at  overpressures  of  the  order  of  150  psi.  All  these  maximum  overpressures  are 
readily  attained  with  small  nuclear  bombs  at  reasonable  ranges.  For  example,  a 
1-kT  (or  10-kT)  surface  burst  produces  peak  overpressures  of  150  psi  at  85 
(185)  m;  30  psi  at  220  (480)  m;  12  psi  at  390  (850)  m;  3  psi  at  980  (2170)  m; 
and  2  psi  at  1320  (2900)  m.  These  yields  will  respectively  evaporate  of  the 
order  of  1000  or  10,000  tons  of  adjacent  material,  and  have  typical  fireball 
radi i  (vaporization  ranges)  of  about  75  m  and  180  m. 

These  figures  suggest  that  a  major  release  can  be  guaranteed  by  arranging 
a  groundburst  even  of  1  kT  within  hundreds  of  meters  of  the  reactor,  and  a 
virtually  complete  release  by  shortening  the  range  to  the  order  of  a  hundred 
meters.  At  virtually  any  site,  delivery  trucks  of  dubious  contents  are 
routinely  driven  within  closer  ranges  than  these.  Many  sites  would  permit  a 
12-psi  overpressure  to  be  achieved  by  a  ki loton-range  bomb  at  standoff  range 

from  public  highways.  Even  a  fizzle  might  suffice:  transmission  lines  and  some 

diesel  air  intakes  fail  at  about  4  psi,  and  this  dual  failure,  unrepaired, 

*If  the  bombing  were  anonymous,  we  would  not  know  whom  to  retaliate  against: 
the  foundation  of  the  strategic-deterrence  doctrine  would  have  vanished. 
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could  cause  a  meltdown  within  hours.  It  is  not  realistic  to  expect  repairs 
within  the  necessary  period  (at  best  an  hour  or  two),  because  even  a  fizzle, 
say  0.1  kT ,  produces  prompt  radiation  of  500  rem  gamma  at  about  300  m,  500  rem 
fast  neutrons  at  about  450  m,  and  500  rem  fallout  dose  in  1-hour  exposure  at 
300-1000  m — all  well  beyond  the  moderate  blast-damage  range  (3  psi)  of  about 
300  m.  It  is  thus  an  environment  in  which  nobody  could  survive  nor,  having 
reentered,  would  wish  to  linger  for  repairs. 

Prior  to  the  work  of  Fetter  &  Tsipis  [1980],  as  noted  earlier,  the  poten¬ 
tial  use  of  small  (e.g.  terrorist)  nuclear  boribs  on  nuclear-facil  ity  targets 
had  not  been  quantitatively  treated  in  the  literature.  On  the  contrary,  such 
analysts  as  Chester  &  Chester  [1970,1974,1976]  had  considered  relatively  short¬ 
term  effects  from  massive  strategic  attacks,  so  they  naturally  found  that  re¬ 
leases  from  reactors  would  not  greatly  increase  the  total  destruction.  Indeed, 
few  analysts  before  Ranberg  [1980]  had  thought  seriously  about  the  whole  prob¬ 
lem  of  power  reactors  in  wartime.  A  few  countries  operating  power  reactors 
have  had  wars  on  their  territory — India,  for  example — without  involving  the 
reactors.  (In  Vietnam,  the  250-kWt  TR1GA  research  reactor  at  Dalat  was  hastily 
dismantled  by  retreating  American  troops  lest  its  radioactive  core  be  released. 
Its  20%-enriched  fuel  was  not  considered  a  safeguards  risk  [Guardian  1975].) 

If  attack  threatened,  would  reactors  be  shut  down,  increasing  safety  at  the 
expense  of  power  supplies?  More  likely,  as  a  Finnish  nuclear  expert  said,  "In 
a  state  of  war  the  criteria  for  safety  of  nuclear  power  stations  would  change." 
[Flood  1976:33] 

This  issue,  however,  is  likely  to  be  taken  more  seriously  following  the 
Iranian  (or  Iranian-marked  Israeli?)  bonb  ing  of  Iraq's  nuclear  research  center 
on  the  outskirts  of  Baghdad  on  30  Septenber  1980  [Boston  Globe  1980;  Marshall 
1980a]  and  the  destruction  of  the  Osirak  reactor  by  an  Israeli  air  raid  on  7 
June  1981.  The  deliberate  targeting  of  the  center — fortunately  just  before  the 
large  Osirak  was  first  loaded  with  fuel — highlighted  the  possibility  of  major 
releases.  The  first  raid  also  gave  Iraq  an  excuse  to  deny  access  to  IAEA 
inspectors  [Koven  1980]  who  wished  to  satisfy  themselves  that  the  12-13  kg  of 
highly  enriched  uranium — enough  for  one  or  two  bonbs — which  France  had  already 
reportedly  delivered  [Marshall  1980a],  out  of  a  planned  consignment  of  70  kg, 
was  not  being  made  into  bonbs.  Senator  Cranston  has  stated  [Hume  1981]  that  he 
has  'been  informed  by  more  than  one  authoritative  Executive  Branch  official 
[that]. ..the  Iraqis  are  enbarked  on  'a  Manhat tan  P roject-type  approach’"  to  use 
the  French  uranium  for  bonbs. 

So  far  we  have  considered  the  vulnerability  of  nuclear  facilities  to  crude 
nuclear  bonbs  made  from  scratch  by  terrorists.  But  far  more  powerful  and  port- 
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able  bombs  may  be  obtainable  from  stockpiles  made  by  the  U.S.  Department  of 
Energy.  There  are  some  7000  assembled  U.S.  bombs  stored  just  in  Europe,  many 
small  enough  to  tuck  under  one's  arm*.  One  of  them,  set  off  near  a  nuclear 
facility,  could  spread  as  much  fallout  as  a  sizeable  nuclear  war.  Nuclear  fa¬ 
cilities  are  thus  such  a  high-leverage  target  that  one  must  consider  all  routes 
by  which  terrorists  might  obtain  a  bomb.  Many  analysts  who,  unlike  us,  con¬ 
sider  homemade  bombs  improbable  give  a  good  deal  more  credence  to  stolen  ones. 

Theft  is  certainly  conceivable.  Security,  lax  a  decade  ago,  is  still  im¬ 
perfect  [Comptroller  General  of  the  U.S.  1980].  A  respected  analyst  states 
[Barnaby  1975]  that  U.S.  Army  blackhat  teams  have  successfully  penetrated  and 
left  bomb  storage  bunkers  without  detection  despite  armed  guards  and  modern 
barriers  and  alarms.  Two  incidents  at  a  Nike  Hercules  base  outside  Baltimore 
suggest  possible  reconnaissance  by  potential  bomb  thieves  [O'Toole  1974].  In 
1979,  journalist  Joseph  Albright  testified  [Dumas  1980:19]  that  by  posing  as  a 
fencing  contractor  he  gained  an  interior  tour  of  two  SAC  bomb  depots  and  their 
weak  points:  on  5  December  1977  he  came  "within  a  stone's  throw  of  four... nu¬ 
clear  weapons"  while  "riding  about  5  mph  in  an  Air  Force  pickup  truck. .  .driven 
by  my  only  armed  escort  [with  one  pistol,  and  both  hands  on  the  wheel.... No 
one]  had  searched  me  or  inspected  my  bulky  briefcase,  which  was  on  my  lap." 
Before  publishing  his  article,  he  purchased  by  mail  blueprints  showing  the  de¬ 
pots'  layout,  a  method  of  disabling  the  alarms,  and  two  unguarded  gates  through 
the  innermost  security  fence;  afterwards  he  received  a  revised  set  showing  "the 
wiring  diagram  for  the  solenoid  locking  system  for  the  B-52  alert  area." 


*Can  terrorists  use  stolen  military  bombs?  Modern  U.S.  bombs — all  those  with 
Permissive  Action  Link  (PAL)  devices,  which  includes  all  those  in  Europe 
[Miller  1979:59] — can  allegedly  be  detonated  only  by  a  proper  numerical  code, 
and  repeatedly  entering  the  wrong  code  irreversibly  scrambles  their  electron¬ 
ics.  This  raises  three  questions  unanswerable  from  open  literature: 

-  Is  it  true  that  PAL-equipped  bombs  cannot  be  set  off  without  a  currently 
authorized  code,  even  by  the  50,000-odd  people  with  up-to-date  PAL  training? 
DeNike  [1975a]  paraphrases  Admiral  La  P.ocque  as  stating  that  "existing  PALs 
malfunction  often  enough  during  practice  drills  that  getting  around  them  has 
become  a  regular  practice.  On  any  nuclear-armed  U.S.  Navy  ship,  there  are  four 
or  five  technicians  trained  to  do  this."  If  so,  PAL  is  not  tamperproof. 

-  Can  a  military  bomb  be  carefully  dismantled  so  as  to  recover  its  core? 
(And  perhaps  its  other  main  components:  any  arming  and  firing  circuits,  and 
indeed  everything  else  up  to  the  detonators,  could  be  readily  replaced  by  an 
electronics  pxpert.)  For  safety  reasons,  most  if  not  all  U.S.  bombs  apparently 
do  not  explosively  disperse  their  cores  if  tampered  with.  Secretary  Schlesinger 
stated  in  1974  [Miller  1979:62]  that  "emergency  destruction  devices  and  proce¬ 
dures  have  been  developed  so  that  nuclear  weapons  may  be  destroyed  without  pro¬ 
ducing  a  nuclear  yield  in  the  event  that  enemy  capture  is  threatened."  But 
that  is  clearly  not  the  same  as  an  automatic  anti-tampering  safeguard. 

-  What  are  the  corresponding  safeguards  in  bombs  made  by  other  countries? 
It  seems  implausible  that  some,  especially  developing  countries,  will  h.’ve 
developed  the  elaborate  and  very  costly  mechanisms  used  in  modern  U.S.  and 
British  bombs  for  command,  control,  and  operational  safety  (including  one-point 
safety,  whose  development  alone  reportedly  cost  billions  of  dollars). 
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The  troublesome  dimension  which  bomb  stockpiles  may  add  to  existing 
nuclear  vulnerabilities  is  relevant  here  because  the  stockpiles  have  already 
experienced  enough  mishaps  to  make  theft,  unauthorized  use,  or  accidental 
detonation  seem  plausible.  The  rate  of  officially  acknowledged  "Broken  Arrows" 
(nuclear  weapons  accidents  short  of  nuclear  detonation)  has  so  far  averaged 
about  one  per  year  or  several  per  thousand  bombs  [Talbot  &  Dann  1981].  Over 
30,000  bombs  are  now  stored  in  up  to  200  sites  in  over  40  states  [id.].  Fur¬ 
ther,  some  3-4 %  of  the  120,000  or  so  carefully  screened  military  personnel  who 
have  the  opportunity  to  detonate  nuclear  weapons  must  be  replaced  each  year — 
nearly  5000  in  1976  alone  [Aspin  1977]  —  for  reasons  ranging  from  drug  abuse 
(about  a  third  of  the  total)  to  mental  problems  to  negligence.  Some  reports 
[Dumas  1980]  suggest  that  such  problems  may  be  increasing,  especially  those 
related  to  drug  use.  An  Army  demolitions  officer  and  seven  GIs,  all  drug  smug¬ 
glers,  were  arrested  in  Karlsruhe  (coincidentally  near  a  German  nuclear  re¬ 
search  center  with  strategic  inventories)  after  plotting  arms  thefts  and  a  raid 
on  an  Army  payroll  office  [id.].  February  1978  press  reports  describe  a  Georgia 
airwoman  who  broke  and  removed  "four  seals  to  the  manual  special  weapons  ter¬ 
minal  handle"  at  a  combat-ready  B-52  guarded  by  soldiers  with  shoot-to-kill 
orders.  French  scientists  testing  a  bomb  in  the  Algerian  Sahara  apparently  had 
to  destroy  it  hurriedly  lest  it  fall  into  the  hands  of  rebellious  French  gen¬ 
erals  led  by  Maurice  Challe  [ Brennan  1968],  and  during  the  Cultural  Revolution 
in  China,  the  military  commander  of  Sinkiang  Province  reportedly  threatened  to 
take  over  the  nuclear  base  there  [J_d.].  Between  theft,  factions,  unauthorized 
use,  accident,  and  horizontal  proliferation,  it  is  no  wonder  some  analysts 
expect,  with  Admiral  La  Rocque  [De  Nike  1975a],  that  "within  ten  years,  we'll 
see  an  atomic  explosion  unauthorized  by  a  government." 

These  issues  are  raised  not  with  the  intention  of  opening  up  the  vast 
subject  of  American  military  policy,  but  merely  to  point  out  that  the  combina¬ 
tion  of  numerous  and  widely  dispersed  bombs,  nuclear  facilities  at  which  one 
bomb  could  mimic  the  fallout  from  a  whole  nuclear  arsenal,  and  imperfect  secur¬ 
ity,  frailties,  or  temptations  within  the  military  could  add  up  to  disaster.  A 
security  system  that  could  not  detect  a  Klaus  Fuchs  at  Los  Alamos  in  wartime 
would  be  hard  pressed  to  detect  an  unstable  airman  at  some  remote  base  in 
peacetime.  Because  nuclear  facilities  in  the  energy  system  can  amplify  the 
effects  of  one  bomb  by  so  many  orders  of  magnitude,  the  risk  latent  in  the 
inventory  of  bombs  (and  their  production  facilities)  may  contribute  as  much  to 
total  peacetime  nuclear  risk  as  all  the  civilian  technologies  considered 

earlier.  If  so,  they  ought  logically  to  be  subject  to  the  same  systematic 
scrutiny  and  the  same  types  of  efforts  at  hazard  mitigation. 
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3.5.  Policy  trends. 


This  chapter  has  described  some  vulnerabilities  of  the  energy  systems  on 
which  all  official  projections  of  America's  energy  future  place  major  and 
increasing  reliance:  oil,  gas  (including  LNG  and  LPG) ,  synfuels,  and  nuclear  and 
coal-fired  central  power  stations  and  their  grids.  These  specific  vulnerabili¬ 
ties,  like  the  generic  ones  surveyed  in  Chapter  2,  are  inherent  in  the  nature  of 
the  technologies.  Some  of  the  risks  we  have  described  may  at  first  seem  far¬ 
fetched — just  as  the  hijacking  of  three  jumbo  jets  to  the  Middle  East  in  one 
week  seemed  implausible  until  it  happened.  But  given  the  consequences,  no  one 
would  wish  to  be  in  the  position  [Drobnick  &  Enzer  1981]  of  the  British  intelli¬ 
gence  officer  who,  on  retiring  in  1950  after  47  years'  service,  reminisced: 

"Year  after  year  the  worriers  and  fretters  would  come  to  me  with  awful  predic¬ 
tions  of  the  outbreak  of  war.  I  denied  it  each  time.  I  was  only  wrong  twice." 

In  the  coming  decades,  salient  trends  that  can  reasonably  be  expected  to 
persist  or  intensify  include:  the  nuclear  and  conventional  arms  races,  East- 
West  rivalries,  North-South  inequities  and  conflicts,  global  political  fragmen¬ 
tation  (often  expressed  as  terrorism),  domestic  tensions  and  political  polari¬ 
zation,  unemployment,  inflation,  financial  and  climatic  instability,  and  doubts 
about  the  vitality  and  reliability  of  global  life-support  systems.  In  such  an 
environment  of  uncertainty,  surprises,  unrest,  and  possible  violence,  an  energy 
system  with  built-in  vulnerabilities  to  all  these  kinds  of  disturbances  is  a 
weakness  we  can  no  longer  afford.  Still  less  can  we  afford  energy  technologies 
which  are  prone  not  only  to  fail  to  deliver  energy  in  these  conditions — with  all 
that  implies  for  the  potential  of  catastrophic  breakdown  in  the  comity  and 
tolerance  of  our  pluralistic  political  system--but  to  create  in  the  process 
hazards  to  life  and  liberty  as  great  as  any  hazards  of  war. 

If  a  central  tenet  of  national  policy  is  to  avoid  placing  ourselves  in  the 
position  of  having  to  choose  between  vital  national  interests,  such  unavoidably 
vulnerable  energy  systems  are  singularly  unappealing  unless  there  is  absolutely 
no  alternative.  Happily,  there  are  technologies  and  energy  systems  which  not 
only  are  less  vulnerable  to  all  kinds  of  failures,  foreseeable  or  not,  but 
which  also  have  other  advantages — in  cost,  speed,  ease,  and  attractiveness.  We 
can  choose  technologies  that  safeguard  both  national  security  and  the  supreme 
interests  which  it  embodies.  As  a  basis  for  developing,  in  subsequent  chap¬ 
ters,  the  elements  of  this  approach,  we  begin  in  the  next  chapter  with  the 
rationale  and  principles  of  a  design  science  of  resilience — the  theoretical 
foundations  for  designing  an  energy  system  consistent  with  national  security  in 
a  free  society. 
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4.  DESIGNING  FOR  RESILIENCE 
4.1.  Resilience  versus  reliability. 


As  we  noted  at  the  end  of  Chapter  1,  efforts  to  make  the  energy  system 
reliable  seek  to  enable  it  to  withstand,  or  at  least  to  make  tolerably  infre¬ 
quent,  calculable,  predictable  kinds  of  technical  failure.  But  Chapters  2  and 
3  have  catalogued  many  incalculable,  unpredictable  kinds  of  disruption — by 
natural  disaster,  technical  failure,  or  malicious  intervention — which  most  of 
today's  energy  systems  cannot  withstand  and  were  not  designed  to  withstand. 
These  systems  were  designed  rather  to  work  with  acceptable  reliability  in  what 
Alfv^n  [1972]  calls  a  "technological  paradise,"  where  everything  happens 
according  to  the  blueprints.  If  such  a  place  has  ever  existed,  the  world 
emerging  in  the  coming  decades  is  certainly  not  it. 

Traditional  analyses  of  the  reliability  of  energy  supplies  have  sought  to 
assess  the  probability  and  consequences  of  failure.  Too  often,  the  probability 
cannot  be  calculated,  and  the  consequences  either  are  plainly  unacceptable  or 
cannot  be  adequately  measured  by  such  traditional  measures  as  degree  of  degrad¬ 
ation,  direct  economic  losses,  duration  and  difficulty  of  restoration,  etc. 
Elaborately  reductionist  taxonomies  have  sought  to  classify  how  systems  can 
fail.  One,  for  example  [Manly  et  al .  1970:100-103],  classifies  the  "vulnera¬ 
bility"  of  a  local  economy  to  disruptions  in  its  control,  process,  input,  and 
output.  Each  of  these  in  turn  can  suffer  "principal  physical  losses,"  "network 
degradation,"  or  "disruption  from  other  losses  or  imbalances,"  each  of  many 
kinds;  and  so  forth.  But  while  this  is  analytically  elegant,  it  offers  no  clue 
to  how  to  design  systems  so  they  are  not  so  vulnerable  in  the  first  place. 

The  vulnerabilities  of  complex  systems  often  cannot  be  foreseen  in  detail. 
A  decade  ago,  intensive  efforts  sought  to  identify  and  to  calculate  the  abso¬ 
lute  probability  of  various  kinds  of  failures  in  hundreds  of  aerospace  systems 
[Bryan  1974;  Comptroller  General  of  the  U.S.  1974],  While  some  useful  insights 
into  the  relative  reliability  of  different  designs  did  emerge,  the  absolute  es¬ 
timates  wildly  understated  the  actual  failure  rates.  Fault-tree  and  event-tree 
methods  predicted,  for  example,  a  failure  rate  of  one  per  10,000  missions  in 
the  fourth-stage  Apollo  engine,  but  the  actual  rate  was  about  four  per  hundred. 
About  20%  of  the  Apollo  ground  test  failures  and  over  35%  of  the  in-flight 
failures  were  of  types  not  considered  credible  until  they  happened  [id.]  —  just 
as  the  Browns  Ferry  and  Three  Mile  Island  accidents  were  of  types  not  consid¬ 
ered  credible  by  the  Rasmussen  Report,  which  used  similar  methods.  The  sheer 
number  of  possibilities  that  must  be  examined  makes  such  analyses  intractable 
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unless  they  are  severely  truncated  by  assuming  that  enormous  numbers  of  unana¬ 
lyzed  but  allegedly  "insignificant"  terms  are  col lect i vel y  insignificant.  But 
in  practice,  many,  perhaps  most,  accidents  follow  these  unexamined  sequences. 

Another  reason  such  analyses  omit  many  actual  causes  of  failure  is  that 
they  assume  complete  knowledge.  Design  or  fabrication  errors  which  have  not 
yet  been  discovered  cannot  be  taken  into  account.  Yet  such  errors  caused  a 
large  fraction  of  the  test  failures  in  the  Atlas  missile  program,  about  half 
the  safety  recalls  of  seven  million  U.S.  cars  in  1973,  and  a  significant  frac¬ 
tion  of  reactor  mishaps.  A  recent  review  of  32  major  accidents  in  reactors, 
aircraft,  ships,  trains,  etc.  [Solomon  &  Salem  1980]  noted  pervasive  gaps  in 
knowledge  about  the  failure  modes'  identity,  significance,  consequences,  like¬ 
lihood,  physical  phenomenology,  initiating  events,  and  interaction  with  other 
factors  (operating  and  maintenance  errors,  multiple  random  component  failures, 
external  events,  etc.).  So  much  is  inevitably  unknown  that  precautions  against 
failure  must  be  general  enough  to  prevent  failure  modes  that  cannot  be  specifi¬ 
cally  identified  in  advance.  Such  precautions  must  embody  resilience  in  the 
design  philosophy,  not  merely  reliability  in  the  design  details. 

Large-scale  failures  which  are  physically  possible  will  occur  sooner  or 
later  as  the  passage  of  time  tests  all  combinations  of  circumstances,  probing 
for  weaknesses.  So  many  "vanishingly  improbable"  failures  are  possible  that 
one  or  another  of  them  is  quite  probable  in  a  given  year.  Our  foreknowledge  of 
failure  is  limited  only  by  the  fertility  of  our  imaginations,  but  the  limits  of 
our  imagination  do  not  affect  what  happens — only  our  degree  of  astonishment. 

Traditionally,  people  have  coped  with  inadequate  knowledge  by  triai  and 
error.  But  in  the  modern  energy  system,  the  cost  of  failure  is  so  high  that  we 
dare  not  do  this.  The  impossibility  of  foreseeing  and  forestalling  all  major 
failures  to  which  the  modern  energy  system  is  vulnerable — of  preventing  all 
surprises — requires  that  we  take  a  different  tack:  learning  to  manage  surprises 
and  make  them  tolerable.  This  requires  [Holling  etal  .  1979:2]  an  analysis  of 
the  unexpected:  "of  the  sources  of  surprise,  the  perception  of  surprise  and  the 
response  to  surprise.  From  that,  together  with  better  understanding,  come  the 
possibilities  of  designs  and  developments  that  can  absorb  and  benefit  from 
surprise."  For  example,  rather  than  just  making  Con  Ed's  switching  relays  more 
reliable  in  order  to  prevent  an  exact  repetition  of  past  catastrophic  grid 
failures,  this  approach  would  seek  to  make  the  grid  resilient — to  make  such 
failures  structurally  impossible,  regardless  of  the  initiating  event,  the  se¬ 
quence  of  failures,  and  whether  or  not  they  were  foreseen.  Equivalently,  a 
strategy  of  resilience  could  seek  to  ensure  that  if  complete  grid  failure  did 
occur,  its  consequences  to  energy  users  would  be  trivial. 
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4.2.  Passive  versus  active  resilience. 


This  sought-after  quality  of  "resilience"  is  difficult  to  define.  The 
word  is  commonly  used  to  refer  only  to  what  Kahn  [1978:3]  calls  "abi 1 i ty . .  .to 
withstand  large  exogenous  [i.e.  caused  from  outside]  disturbances.  The  usual 
power  system  planning  framework  does  not  address  itself  to  the  occurrence  of 
droughts,  coal  strikes  or  major  inter-regional  supply  deficiencies.  The  abili¬ 
ty  to  absorb  such  shocks  gracefully  has  been  called  the  'resilience'  of  a  sys¬ 
tem."  But  "resilience,"  he  continues  {  :  1 9 ]  ,  "...incorporates  both  a  passive, 
behavioral  notion  and  an  active  feedback  control  notion.  A  resilient  system 
absorbs  shock  more  easily  than  a  'rigid'  system;"  that  is,  when  stressed  it 
gives  way  gracefully  without  shattering.  "This  is  a  passive  character i zat ion . 
[But  the] .. .correct ive  response  to  disturbance  is  an  active  control  notion. 

In  the  case  of  power  systems,  the  corrective  response  ultimately  involves  the 
political  economy  in  which  the  [technical]  system  is  embedded.  Regulatory 
agencies  institute  investigations  of  major  disturbances  and  initiate  action  to 
reinforce  perceived  weaknesses."  Thus  passive  resilience  is  mere  ability  to 
bounce  without  breaking;  active  resilience  also  connotes  the  adaptive  quality 
of  learning  and  profiting  from  stress  by  using  it  as  a  source  of  information  to 
increase  "bounciness"  still  further.  In  the  spirit  of  this  metaphor,  a  rubber  ball 
has  passive  resilience;  the  nerves  and  muscles  of  someone  learning  to  play 
basketball  have  active  resilience.  Energy  systems  need  both,  but  most 
currently  have  neither. 

Kahn  [1978]  provides  one  of  the  few  quantitative  analyses  of  passive 
resilience  by  comparing  the  reliability  of  electrical  supply  from  two  hypothe¬ 
tical  grids:  one  powered  mainly  by  central  thermal  plants,  the  other  by  wind 
turbines.  (For  simplicity,  the  role  of  transmission  and  distribution  systems 
is  ignored  in  both  cases.)  Kahn  focuses  not  on  the  relative  size  or  dispersion 
of  the  power  plants  but  rather  on  their  reliability  statistics — their  "control¬ 
lability"  or  intermittence.  On  simplified  and  probably  conservative  assump¬ 
tions  (favoring  the  steam  plants),  the  two  systems  can  be  made  equally  reliable 
if  the  wind-dominated  system  is  given  slightly  more  storage  capacity. 

Kahn  then  asks  not  what  might  be  the  probabilities  of  various  detailed 
failure  modes,  as  traditional  reliability  analysts  would  do — the  "highly  speci¬ 
fied  network  analysis  and  contingency  enumeration  approach"  [ :  1 9 ] — but  rather 
how  the  reliability  of  these  two  systems  would  change  if  each  type  of  genera¬ 
tion  worked  less  reliably  than  expected.  He  "perturbs"  the  system  by  assuming 
worse  performance  all  around,  such  as  might  be  caused  by  a  coal  strike,  oil 
embargo,  generic  nuclear  shutdown,  drought,  cloudy  or  windless  period,  etc. 

The  absolute  amount  of  assumed  degradation  is  the  same  for  both  grids,  but  in 
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percentage  terms  it  affects  wind  less  than  central-station  generators  because 
the  wind  generators  are  already  more  subject  to  fluctuations:  they  are  already 
intermittent  and  cannot  get  much  more  so.  Their  grid  was  des  igned  to  cope  with 
fluctuation  and  has  "bitten  the  bullet"  by  providing  adequate  windpower  and 
storage  capacity.  But  an  equal  amount  of  increase  in  the  failure  rate,  whatev¬ 
er  its  cause,  is  far  more  serious  for  the  central-station  system,  which  was 
designed  on  the  assumption  of  high  reliability  and  rapidly  breaks  down  without 
it.  From  the  dispatcher's  point  of  view,  degrading  reliability  by  10%  or  more 
makes  the  central-station  grid  about  five  times  less  reliable  than  the  wind- 
based  grid.  The  central  plants'  storage  or  backup  requirements  to  maintain 
equal  reliability  zoom  up  far  more  steeply  and  to  much  higher  levels  than  those 
of  similarly  degraded  wind  plants.  (Alternatively,  if  the  reliability  require¬ 
ments  were  somewhat  relaxed,  the  renewable  grid  could  take  more  additional  load 
than  the  central-station  grid  (  : 20 ]  ,  or  equivalently  would  show  a  greater  sav¬ 
ing  in  backup  or  storage  capacity.)  This  "supports  the  thesis  associated  with 
Lovins  that  the  intermittent  [ sources ]... produce  a  more  resilient  system"  [ : 3 ] . 

Kahn  thus  finds  [1979:343-344]  that  "the  impact  of  unusual  or  extreme 
c i rcums tances .. .mode  1  led  as  extra  [ stat i st i cal ]  variance  or  uncertainty ...[ i s] 
smaller... on  the  wind  energy  system  than  on  the  conventional  one ...[ showing]  a 
greater  ability  to  absorb  risk."  He  cites  [_id_.]  similar  conclusions  in  the 
power-system  control-theoretic  literature  and  in  a  British  wind-energy  analysis 
by  the  Astronomer  Royal,  Sir  Martin  Ryle  [1977].  Sir  Martin's  design  for  a 
British  wind  system  was  more  resilient  than  that  of  the  Central  Electricity 
Generating  Board  [Leicester  et  al .  1978;  Anderson  etal.  1978]  because  it  sac¬ 
rificed  a  little  performance  at  high  windspeeds  in  order  to  be  able  to  operate 
at  low  ones,  and  therefore  could  work  most  of  the  time.  In  a  long  period  of  low 
windspeed,  Sir  Martin's  design  would  still  produce  power  much  of  the  time,  while 
the  CEGB's  overdesigned  machines  would  produce  none  at  all,  requiring  over  five 
times  as  much  storage.  The  more  "resilient  system  minimizes  the  impact  of  ex¬ 
treme  conditions...."  Such  resilience  "has  important  consequences.  It  means 
...that  exogenous  uncertaint ies . . .have  already  been  built  into  the  system. 
Therefore  the  impact  of  the  marginal  risk  goes  down." 

Passively  resilient  energy  systems  offer  no  benefit  unless  used.  The 
process  of  learning  to  use  them  is  a  kind  of  active  resilience.  Biological 
systems  have  this  learning  and  corrective  process  built  in.  It  provides  the 
adaptability  that  has  carried  these  systems  through  several  billion  years  in 
which  environmental  stresses  were  so  great  that  all  designs  lacking  resilience 
were  recalled  by  the  Manufacturer  and  are  therefore  no  longer  around  to  be 
studied.  To  understand  active  resilience  so  that  we  can  apply  it  to  the  design 
of  energy  systems,  we  need  to  examine  the  architecture  of  biological  systems 
that  have  survived  the  exacting  test  of  evolution. 


138 


This  is  a  central  theme  of  several  provocative  articles  by  the  Canadian 
ecologist  C.S.  Holling.  He  describes  many  instances  in  which  the  learning 
qualities  of  an  ecosystem,  not  just  its  passive  "safety  margins"  or  its  redun¬ 
dancy  (like  having  an  extra  kidney),  enable  it  to  emerge  strengthened  by  having 
experienced  stress.  Holling' s  arguments  about  biological  resilience  are  framed 
in  the  language  of  abstract  mathematics*,  but  at  the  cost  of  losing  some  of  his 
subtler  insights,  we  shall  summarize  them  here  in  ordinary  terms. 

4.3.  Resilience  in  biological  systems. 

Our  earlier  discussion  (pages  17-18  above)  of  the  Borneo  and  Canete  Valley 
ecosystems  found  that  when  they  were  disturbed,  unforeseen  inter 1 inkages  with¬ 
in  them  made  them  lose  their  ecological  stability.  "Stability"  in  this  sense 
does  nor  mean  a  static  equilibrium,  but  rather  the  ability  of  a  system  to 
regulate  itself  so  that  normal  fluctuations  in  its  populations  of  plants  and 
animals  do  not  reach  the  point  of  either  extinction  or  plague.  The  system  does 
not  remain  exactly  the  same — it  is  free  to  vary — but  it  varies  only  within  one 
general  mode  of  behavior  that  is  recognizable  and  coherent. 

Self-regulation  that  works  only  so  far  is  common  in  biological  systems.  As 
Garrett  Hardin  has  pointed  out  (Holling  &  Goldberg  1971:225;  emphasis  added], 
our  bodies  regulate  their  own  temperature  at  about  98.6°F.  "If  through  sick¬ 
ness  or . . .dramat ic  changes  in  external  temperature,  the  body  temperature  begins 
to  rise  or  fall,  then  negative  feedback  processes  bring  [it]  back  to  the  equi¬ 
librium  level.  But... this  regulation  occurs  only  within  limits.  If  the  body 
temperature  is  forced  too  high... the  excessive  heat  input  defeats  the  regula¬ 
tion,  ...[  increasing]  metabolism  which  produces  more  heat,  which  produces  higher 
temperatures,  and  so  on.  The  result  is  death.  The  same  happens  if  temperature 
drops  below  a  critical  boundary.  We  see,  therefore,  even  in  this  simple  sys¬ 
tem,  that  stability  relates  not  just  to  the  equilibrium  point  but  to  the  domain 
of  temperatures  over  which  true  temperature  regulation  can  occur.  It  is  [the 
breadth  of]  this  domain  of  stability  that  is  the  measure  of  resilience." 

*A  new  branch  of  mathematics  known  as  "catastrophe  theory"  [Thom  1975; 

Stewart  1975;  Woodcock  &  Davis  1978]  deals  with  discontinuous  changes  in  the 
state  of  complex  systems.  It  is  able  to  classify  these  changes — which  can  be, 
for  example,  only  of  seven  basic  kinds  in  a  system  controlled  by  four  variables 
— and  can  describe  them  by  geometrical  analogies.  (Strictly  speaking,  the 
style  of  mathematics  is  more  that  of  topology,  which  deals  with  the  most  gener¬ 
al  properties  of  geometric  forms,  such  as  how  many  holes  they  have  through 
them,  without  being  concerned  with  their  exact  size  or  shape.)  Holling's  re¬ 
sults  do  not  rely  on  the  theorems  of  catastrophe  theory,  but  do  borrow  some  of 
its  terminology.  Readers  with  good  mathematical  intuition  are  urged  to  read 
Holling  in  the  original  [1978;  Holling  et  al .  1979]. 
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More  complex  systems  with  more  variables  also  have  their  domains  of  stable 
self-regulation  beyond  which  they  break  down.  Regardless  of  the  degree  of  com¬ 
plexity,  successful  (i.e.  surviving)  ecosystems  "are  those  that  have  evolved 
tactics  to  keep  the  domain  of  stability,  or  resilience,  broad  enough  to  absorb 
the  consequences  of  change."  [Holling  &  Goldberg  1971:225;  emphasis  added] 

These  systems  do  not  attain  the  absolute  pinnacle  of  biological  efficiency  in 
capturing  available  energy,  but  by  avoiding  the  extreme  spec ial i zat ion  this 
would  require,  they  also  avoid  the  risk  of  "contraction  of  the  boundaries  of 
stability" — a  reduced  margin  of  adaptability. 

Holling  [1978:99-104]  describes  several  possible  ways  to  view  these 
"domains  of  stability"  and  hence  to  judge  the  resilience  of  an  ecosystem.  For 
example,  one  mathematically  simple  and  politically  comforting  view,  widely  held 
by  non-biologists,  is  that  the  domains  of  stability  are  infinitely  large — that 
nature  is  infinitely  resilient,  tolerant,  and  forgiving.  In  this  view,  no 
matter  how  drastically  a  system  is  disturbed,  it  will  always  bounce  back. 

An  opposing  view  holds  that  nature  is  so  delicately  balanced  that  the 
domains  of  stability  are  infinitely  small,  so  that  any  slight  disturbance  will 
lead  to  extinction.  If  this  were  literally  true,  hardly  anything  would  by  now 
be  left  alive.  But  this  view  is  not  so  indefensible  if  applied  only  locally, 
not  globally,  because  then  temporary  extinction  in  one  place  can  be  made  up  by 
recolonization  from  adjacent  areas.  Some  classical  experiments  in  population 
biology  illustrate  this  process.  For  example,  if  two  kinds  of  mites,  one  eat¬ 
ing  plants  and  the  other  eating  the  first  kind  of  mite,  are  confined  within  a 
small  area,  both  the  predator  and  the  prey  populations  will  drop  to  zero  as 
their  oscillating  interactions  outrun  their  respective  food  supplies.  But  if 
the  enclosure  is  divided  by  barriers  into  sub-regions,  between  which  either 
kind  of  mite  can  move  with  some  delay  and  difficulty,  then  since  the  population 
cycle  of  outbreak  and  collapse  proceeds  at  slightly  (and  randomly)  different 
rates  in  different  sub-regions,  both  the  predator  mites  and  their  prey  can 
recolonize  from  surplus  to  deficit  areas.  This  ensures  the  survival  of  both 
species  someplace  in  the  enclosure.  That  experiment  illustrates  the  important 
conclusion  that  if  domains  of  stability  are  small — if  a  system  is  fragile — it 
will  benefit  from  being  fine-grained  and  heterogeneous  in  space.  Failure  then 
does  not  propagate  and  can  be  repaired  from  areas  still  functioning.  Local 
backup,  local  autonomy,  and  a  preference  for  small  over  large  scale  and  for 
diversity  over  homogeneity  all  increase  resilience  in  such  cases. 

A  possible  view  precisely  between  the  extremes  of  supposing  nature  to  be 
infinitely  brittle  or  infinitely  resilient  is  the  view  that  the  behavior  of 
ecosystems  is  neutral,  tending  toward  neither  stability  nor  instability,  and 
neither  endangered  nor  protected  by  general  features  of  system  arch i tecture . 
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The  coupled  differential  equations  commonly  used  to  represent  the  interactions 
between  two  populations  embody  this  view  by  assuming  that  the  populations  can 
fluctuate  without  limit,  influenced  only  by  each  other.  This  view,  again,  is 
mathematically  convenient  but  greatly  oversimplified.  If  it  is  refined  by 
adding  any  kind  of  negative  feedback  (for  example,  that  population  outbreaks 
will  be  constrained  by  crowding  effects),  then  collapse  becomes  impossible.  On 
the  other  hand,  adding  any  kind  of  positive  feedback,  or  time  lags  in  respond¬ 
ing  to  events,  creates  instability  and  makes  collapse  inevitable.  Yet  both 
negative  and  positive  feedbacks  ac t ual 1 y  exist  in  real  ecosystems,  leading  to  a 
mix  of  stabilizing  and  destabilizing  properties  whose  relative  dominance  varies 
in  time  and  space.  It  is  the  balance  of  these  stabilizing  and  destabilizing 
forces  that  enables  ecosystems  to  regulate  themselves  into  a  semblance  of 
stability — provided  they  are  not  pushed  too  far,  into  a  region  of  behavior 
where  the  instabi  l  it  ies  dominate  and  cause  collapse. 

In  all  but  perhaps  the  simplest  ecosystems,  these  mathematical  properties 
create  (as  both  theory  and  experiment  confirm)  not  just  one  domain  of  stabili¬ 
ty,  or  region  of  equilibrium  behavior,  but  multiple  doma ins  of  stability.  Each 
represents  a  "basin"  within  which  the  behavior  of  the  system  can  "slop  around" 
without  dramatic  change.  But  if  some  variable  important  to  the  system's  beha¬ 
vior  exceeds  its  range  of  stable  values,  the  system  can  abruptly  change  into  a 
different  "basin"  of  behavior  by  "slopping  up  over"  the  "ridge”  between  adja¬ 
cent  "basins."  Eutrophication  of  a  pond  is  such  a  change.  If  more  and  more 
nutrients  (e.g.  phosphates)  are  added  to  the  water,  eventually  its  limits  of 
tolerance  will  be  reached.  It  will  suddenly  develop  an  algal  bloom,  which  can 
lead  to  rotting  of  the  plant  matter  and  the  irreversible  creation  of  anerobic 
conditions.  The  pond  can  then  not  support  its  original  species  or  perhaps  any 
others.  Similarly  abrupt  transitions,  triggered  by  seemingly  small  disturban¬ 
ces  to  critical  variables,  can  apparently  occur  in  marine  biology  iPlatt  et 
a  1 .  1977],  in  global  climate  [Lorenz  1976],  and  even  in  political  and  economic 
systems  (as  in  the  Great  Depression,  revolutions,  and  similar  cataclysms). 

If  ecosystems  have  multiple  domains  of  stability  and  can  be  easily  trig¬ 
gered  to  switch  from  one  to  another,  the  strategy  for  avoiding  such  a  transi¬ 
tion  is  to  stay  far  away  from  the  "ridge"  separating  one  domain  or  "basin"  of 
stability  from  the  next.  This  is  precisely,  as  Holling  [ 1978 : 102f]  remarks, 

"in  the  highly  responsible  tradition  of  engineering  for  safety,  of  nuclear 
safeguards,  of  environmental  and  health  standards."  But,  to  add  emphasis,  this 
approach  "demands  and  presumes  knowledge.  It  works  beautifully  if  the  system 
is  simple  and  known — say,  the  design  of  bolts  for  an  aircraft.  Then  the  stress 
limits  can  be  clearly  defined,  these  limits  can  be  treated  as  if  they  are 
static,  and  the  bolt  can  be  crafted  so  that  normal  or  even  abnormal  stresses 
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can  be  absorbed.  The  goal  is  to  minimize  the  probability  of  failure.  And  in 
that,  the  approach  has  succeeded.  But  in  parallel  with  that  achievement  is  a 
high  cost  of  failure — the  very  issue  that  now  makes  trial-and-error  methods  of 
dealing  with  the  unknown  so  dangerous.  Far  from  being  resilient  solutions, 
they  seem  to  be  the  opposite,  when  applied  to  large  systems  that  are  only 
part i al 1 y  known .  To  be  able  to  ident  i  fy  . .  .  [ safe  l imi t s ]... presumes  sufficient 
knowledge."  Thus  the  engineering-for-safety  approach  "emphasizes  a  fail-safe 
design  at  the  price  of  a  safe-fail  one."  If  the  inner  workings  of  a  system  are 
not  perfectly  understood  and  predictable,  efforts  to  remain  within  its  domain 
of  stability  may  fail,  leading  not  to  safety  but  to  collapse. 

Worse,  because  the  hidden  processes  and  parameters  that  determine  the  size 
of  that  domain  are  continually  (if  slowly)  changing  in  time,  and  because  they 
may  interact  with  outside  influences  in  ways  that  may  not  be  perceived  in 
advance,  changing  the  values  of  key  parameters  in  a  well-meant  effort  to 
ensure  safety  may  actually  create  new  dangers.  Intervention  can  "shrink"  or 
even  "implode"  domains  of  stability,  throwing  the  system  unexpectedly  into 
unstable  or  catastrophic  behavior  modes — just  as  spraying  pesticides  in  the 
Canete  Valley  made  a  previously  resilient  ecosystem  too  brittle  to  cope  with 
normal  fluctuations  in  growing  conditions. 

If  the  position  of  each  stability  boundary  could  be  perfectly  known  and 
the  distance  to  it  monitored  and  controlled,  safety  might  be  possible.  But  in 
the  absence  of  perfect  knowledge,  efforts  at  such  control  are  more  likely  to 
shrink  the  domain  of  stability  and  to  sh i ft  its  boundaries  in  unexpected  direc¬ 
tions.  The  WHO  thought  it  was  using  safe  levels  of  DDT  in  Borneo,  but  not  that 
this  intervention,  focused  on  providing  a  narrow  form  of  safety — eradication  of 
malaria — would  so  destabilize  other  interactive  predatoi — prey  relationships  as 
to  result  in  plague.  "This  dynamic  pattern  of  the  variables  of  the  system  and 
of  its  basic  stability  structure,"  writes  Holling  [1978:104],  "lies  at  the 
heart  of  coping  with  the  unknown." 

Striving  merely  for  passive  resilience — "the  property  that  allows  a  system 
to  absorb  change  and  still  persist" — means  striving  to  stay  away  from  the  boun¬ 
daries  of  stability.  Yet  as  interventions  and  environmental  changes  constantly 
shift  those  boundaries,  actions  that  used  to  be  stabilizing  may  become  destabi¬ 
lizing,  and  far-off  boundaries  may  become  near  or  be  transgressed.  A  strategy 
mindful  of  the  limits  of  knowledge,  therefore,  is  to  strive  for  active  resili¬ 
ence — "a  property  that  allows  a  system  to  absorb  and  utilize  (or  even  benefit 
from)  change."  This  approach  implies  very  different  management  methods:  for 
example,  environmental  standards  loosened  or  tightened  according  to  the  needs 
of  the  stressed  ecosystem.  It  places  a  premium  on  adaptation — on  making  time 
constants  long  for  dangerous  changes  and  short  for  measures  responding  to  them. 
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Ecosystems  achieve  active  resilience  partly  by  their  layered  structure  of 
successively  more  complex  and  specialized  organisms.  Low-level  layers  contain  a 
relatively  large  number  of  relatively  small  components  with  different  functions. 
The  integration  of  these  components  produces  or  supports  the  next  higher  layer, 
as  in  a  food  chain.  Successively  higher  layers  cover  a  larger  area  and  work 
more  slowly.  Within  this  complex  structure,  at  each  level,  "the  details  of 
operations  [among]  the  components  can  shift,  change,  and  adapt  without  threat¬ 
ening  the  whole"  [_i_d.  :  105-106]  .  For  example,  ecosystems  use  many  overlapping 
populations  to  perform  the  same  function,  such  as  primary  production,  partly 
because  of  uncertainty:  since  sunlight  is  not  uniform,  for  example,  a  diverse 
forest  may  contain  both  sun-loving  and  shade-tolerant  plants.  "Any  particular 
function  represents  a  role  that  at  different  times  can  be  performed  by  different 
actors  (species)  that  happen  to  be  those  available  and  best  suited  for  the 
moment."  [:105-106]  The  mathematics  of  hierarchical  structures  allows  rapid 
evolution  and  the  absorption  and  utilization  of  unexpected  events." 

The  importance  of  a  layered  structure  is  illustrated  by  an  anecdote  about 
the  different  working  methods  of  two  imaginary  Swiss  watch-makers  [id.]: 

One  watch-maker  assembles  his  watch  as  .  sequence  of  subassemblies — a  hier¬ 
archical  approach.  The  other  [merely] .. .bui Ids  from  thp  basic  elements. 
Each  watch-maker  is  frequently  interrupted  by  phone  calls  and  each  inter¬ 
ruption  causes  an [ y  incomplete]  assembly  to  fall  apart.... If  the  interrup¬ 
tions  are  frequent  enough,  the  second  watch-maker,  having  always  to  start 
from  scratch,  might  never  succeed  in  making  a  watch.  The  first...,  how¬ 
ever,  having  a  number  of  organized  and  stable  levels  of  assembly,  is  less 
sensitive  to  interruption.  The  probability  of  surprise  (of  failure)  is  the 
same  for  each.  The  cost.. .is  very  different!,  in  that  one  maker  is  able  to 
finish  building  watches  while  the  other  never  can]. 

. . .[Mjissing  steps  in  a  hierarchy  will  force  bigger  steps  [which]  take  a 
longer  time  [ and] .. .presume  the  greatest  knowledge  and  require  the  greatest 
investment.  Hence,  once  initiated,  they  are  more  likely  to  persist  even  in 
the  face  of  obvious  inadequacy.  Finally,  bigger  steps  will  produce  a 
larger  cost  if  failure  does  occur.  To  avoid  that,  the  logical  effort  will 
be  to  minimize  the  probability  of. ..of  surprises  or  of  failures. 

For  example,... a  nurnDer  of  watch-makers  [might ]... join  together,  pool 
their  resources,  occupy  a  large  building,  and  hire  a  secretary  to  handle 
the  phone  calls.  This  would  control  the ...  interrupt i ons  and  both  watch¬ 
building  strategies  would  succeed.  Without  the  interruptions,  there  is 
not  that  much  to  gain  by  maintaining  very  many  steps  in  a  hierarchy  of  sub- 
assemblies.  (Having  fewer  steps  between  larger  subassembl ies] .. .might 
increase  efficiency  and  produce  economies  of  scale  but  is  totally  dependent 
on  complete  and  invariant  control  of  disturbance.  If  the  secretary  were 
sick  for  one  day  production  would  halt. 

Imitating  the  strategy  of  successfully  resilient  ecosystems,  then,  may  not 
wring  out  the  last  ounce  of  "efficiency"  or  attain  the  acme  of  specialization 
that  might  be  optimal  in  a  surprise-free  world.  But  in  a  world  of  uncertainty, 
imperfect  knowledge,  and  constant  change,  that  strategy  does  win  an  even  richer 
prize — minimizing  unexpected  and  disastrous  consequences  [Holling  4  Goldberg 
1971:229]  which  can  arise  when  the  causal  structure  of  a  real  system  turns  out 
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to  be  qual i tat i vely  different  than  expected.  Hoi ling  et  al .  [1979]  illustrate 
the  dangers  of  narrowly  "efficient"  interventions  with  five  practical  examples: 

-  Spraying  to  control  spruce  budworm  in  eastern  Canada.  This  protects  the 
pulp  and  paper  industry  in  the  short  term.  But  the  populations  of  budworms, 
their  avian  and  mammalian  predators,  tree  foliage,  etc.  are  continually  chang¬ 
ing  anyhow  on  many  different  time-scales,  with  fast,  intermediate,  and  slow 
variables.  Spraying  disturbs  only  the  fast  variables,  sending  an  intricate  web 
of  dynamic  relationships  into  a  new  behavior  mode:  reduced  tree  growth,  chronic 
budworm  infestation,  outbreaks  over  increasing  areas,  and — if  spraying  stops — 
high  vulnerability  "to  an  outbreak  covering  an  area  and  of  an  intensity  never 
experienced  before."  The  sprayers'  mental  model  has  one  element — that  spraying 
kills  budworms,  which  eat  trees,  which  are  worth  money — whereas  even  the  simp¬ 
lest  successful  simulation  models  of  the  system  have  thousands  of  variables. 

-  Protecting  and  enhancing  salmon  spawning  on  the  west  coast  of  North 
America  triggers  increased  fishing  and  investment  pressure  to  profit  from  the 
larger  harvest.  These  extinguish  less  productive  stocks  and  leave  fishing  "pre¬ 
cariously  dependent  on  a  few  enhanced  stocks  that  are  vulnerable  to  collapse." 

-  Suppressing  forest  fires  in  U.S.  National  Parks  succeeds  in  the  short 
term,  but  also  accumulates  unburned  fuel  which  leads  inevitably  to  "fires  of  an 
extent  and  cost  never  experienced  before." 

-  Transforming  semi-arid  savannah  into  productive  cattle-grazing  systems 
in  parts  of  the  U.S.,  Africa,  India,  and  Australia  also  changes  the  grass  com¬ 
position  so  as  to  cause  an  irreversible  switch  to  woody  vegetation.  The  resul¬ 
ting  altered  ecosystem  is  highly  susceptible  to  drought-triggered  collapse. 

-  Some  malarial  eradication  programs  have  succeeded  only  long  enough  to 
produce  DDT-res i stant  mosquitos  and  human  populations  with  little  immunity, 
leading  in  turn  to  greatly  intensified  outbreaks. 

In  each  of  these  examples,  like  the  Canete  Valley  spraying  mentioned  in 
Chapter  1,  a  problem  was  made  worse  by  defining  it  more  restrictively  than  the 
interactive  nature  of  the  ecosystem  permitted.  Intervention  shrank,  shifted, 
or  destroyed  the  original  ecosystem's  stability  domains,  making  behavior  "shift 
into  very  unfamiliar  and  unexpected  modes"  { : 2 7 ]  .  Some  disturbed  systems  "for¬ 
got"  their  previous  history  and  became  "more  sensitive  to  unexpected  events 
that  previously  could  be  absorbed." 

Hoi  1 ing  et  al .  conclude  that  when  ecosystems  turn  out  to  be  unexpectedly 
complex,  leading  to  apparently  unpredictable  side-effects,  the  institutions 
responsible  tend  to  respond  in  one  of  three  ways: 

First!,]  they  may  try  to  design  away  the  variability  by  deliberately  simp¬ 
lifying  the  system  and/or  its  environment  [e.g.  by  seeking  to  eradicate 

predators,  "pests,"  or  "weeds" — often  with  intractable  side-effects]. 


Second,  they  may  try  to  extend  the  boundaries  of  definition  of  the 
natural  system,  so  as  to  include  "all  relevant  factors"  in  their  analyses 
[via  elaborate  models  and  large  interdisciplinary  research  groups — an 
approach  equally  doomed  to  failure  but  slower  to  appreciate  it].... 

Third,  they  may  simply  try  to  find  ways  to  live  with  high  variability. 
There  are  at  least  two  design  possibilities  for  living  with  surprise. 

First,  the  institution  may  attempt  to  design  some  means  to  stabilize 
system  outputs  without  stabilizing  system  states,  by  finding  some  way  to 
store  up  outputs  and  release  them  in  a  more  or  less  steady  stream.  Indivi¬ 
duals  hedge  against  uncertainty  by  storing  money  in  savings  accounts;  dams 
store  water  for  release  in  dry  per i ods . . . .Th i s  design  approach  is  the  most 
promising,  in  terms  of  social  acceptabi 1 i ty ,  that  we  have  uncovered  so  far. 
Finally,  the  institutions  may  attempt  to  spread  risks  by  disaggregating  the 
system  into  'operational  units,'  each  with  a  relatively  low  cost  of  failure 
[and  minimally  interdependent  on  each  other ]... .For  example, .. .the  energy 
planner  must  be  able  to  design  parallel  deve lopment .. .opt i ons ...  such  that 
failure  of  one  does  not  drag  the  others  down  also. 

Subsequent  Chapters  will  expand  on  these  last  two  approaches — smoothing  and  dis¬ 
aggregating  energy  supplies.  They  are  indeed  the  "most  promising"  approaches 
for  making  tolerable  those  surprises  that  cannot  be  reduced  to  expectations. 


4.4.  Design  principles  for  resilience. 

Designers  of  aircraft,  reactors,  military  hardware,  water  and  telecommuni¬ 
cations  systems,  etc.  have  long  sought  to  achieve  at  least  passive  resilience — 
to  avoid  the  "brittleness"  of  systems  that  shatter  if  stressed  beyond  their 
limits.  In  this  quest  they  have  developed  by  trial  and  error  a  number  of  tacit 
principles  of  design.  (We  say  "tacit"  because  few  have  been  written  down. 
Classic  texts  of  reactor  engineering  [e.g.  Thompson  &  Beckerley  1964-70]  have 
far  more  to  say  about  specific  design  embodiments  which  may  be  resilient  than 
about  the  general  principles  of  formulating  such  designs,  and  even  such  acknow¬ 
ledged  experts  in  resilient  design  as  F.R.  Farmer  and  S.  Hanauer  do  not  seem  to 
have  formalized  their  extensive  design  experience.)  These  principles  mirror 
those  used  in  biological  organization  to  achieve  active  resilience. 

The  elements  of  resilient  design  can  be  described  qualitatively,  but  are 
exceedingly  difficult  to  pin  down  in  numbers.  They  are  also  not  all  mutually 
consistent  and  compatible,  so  some  compromises  between  them  are  necessary — a 
process  with  which  living  things  are  not  yet  fully  satisfied  after  several 
billion  years,  so  it  will  doubtless  take  human  analysts  quite  a  while  too. 
Deferring  to  Chapter  5  the  fuller  discussion  of  issues  related  to  the  scale  and 
decentralization  of  individual  components  of  the  energy  system,  we  consider  here 
the  broad  principles  of  dispersion,  numerical  redundancy,  functional  redundancy, 
diversity,  interconnect i on ,  functional  flexibility,  modularity,  standardization, 
internal  decoupling  and  buffering,  simplicity,  forgivingness,  reproducibility, 
speed  of  evolution,  accessibility,  and  social  compatibility. 
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D i spers  ion  has  long  been  a  cardinal  rule  in  military  tactics — not  bunching 
up  all  one’s  forces  in  vulnerable  concentrations.  The  military  value  of  dis¬ 
persing  energy  sources  is  illustrated  by  the  examples  we  reviewed  on  pp.  49-50, 
notably  the  case  of  Japanese  hydroelectricity  in  World  War  II.  Dispersion  of 
industrial  facilities  was  recommended  in  the  U.S.  in  the  first  post-Hiroshima 
strategic  review  [Joint  Committee  on  Defense  Production  1977:1:99]  and  is  con¬ 
sidered  desirable,  if  not  always  practiced,  in  the  USSR  [_id  . : II :75-77 ]  .  Geo¬ 
graphic  dispersion  means  that  if  a  mishap  occurs  in  a  particular  place,  it  is 
more  likely  that  some  units  will  be  there  but  less  likely  that  they  will  all  be 
there,  so  the  maximum  simultaneous  loss  is  reduced.  Dispersion  on  a  sufficient 
scale  (typically  hundreds  of  miles)  can  smooth  out  local  weather  fluctuations: 
it  increases,  for  example,  the  average  net  output  of  an  array  of  wind  machines 
[Kahn  1979:320],  because  although  they  may  not  all  be  exposed  to  high  winds  at 
the  same  time,  neither  are  they  likely  to  be  simultaneously  becalmed. 

Dispersion  does  not  necessari ly  imply  small  unit  scale.  (Appendix  C  ex¬ 
plains  the  complex  semantics  of  such  terms  as  "decent ral i zat i on . ")  Dispersion 
refers  only  to  the  degree  of  geographic  concentration  of  units,  and  hence  may 
refer  only  to  remote,  scattered  siting  of  a  few  large  units.  Only  by  spreading 
out  a  relatively  large  number  of  relatively  small  units  can  one  obtain  most  of 
the  reduction  in  vulnerability  exhibited  by  e.g.  the  Japanese  hydro  example. 

With  dispersion  and  small  unit  scale,  the  number  of  users  affected  by  any  one 
failure  will  be  small,  so  each  unit  will  be  a  low-priority  target  and  its 
failure  of  less  social  consequence.  Regardless  of  unit  size,  dispersion  can 
provide  a  local  source  of  supply  for  nearby  users — though  it  need  not,  as  shown 
by  the  notorious  case  of  Native  American  settlements  in  sight  of  the  Four 
Corners  power  plant  but  still  without  electricity.  But  if  units  remain  large, 
"dispersion"  means  remoteness  from  those  users  away  frcm  whom  the  units  were 
dispersed.  This  requires  those  users  to  rely  on  a  farflung  distribution  system 
which  may  increase  total  vulnerability.  We  return  to  this  point  below. 

Numerical  redundancy  means  having  extra  capacity  so  that  one  unit  can  back 
up  or  replace  another.  It  is  easiest  with  small,  relatively  cheap  units.  It  is 
a  familiar  method  of  improving  technical  reliability.  Because  its  extra  costs 
are  clearly  visible,  it  is  often  ignored,  as  in  many  giant  oil  tankers  whose 
steering  and  other  vital  functions  depend  on  unreplicated  steam  sources  [Mostert 
1974],  Even  military  hardware,  not  noted  for  cost-shaving,  sometimes  makes  the 
same  mistake:  DD-963  class  destroyers,  for  example,  have  waste  heat  boilers  that 
are  "extremely  difficult,  if  not  imposs ible[ , ]  to. . .maintain.  Equipment  failure 
would  result  in  partial  loss  of  ship's  electrical  power,  potentially  affecting 
ship's  weapon  systems” — a  sign  of  inadequate  backup  [Comptroller  General  of  the 
U.S.  1981:61]  . 
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Numerical  redundancy  can  cause  complications.  If  it  needs  a  "voting  sys¬ 
tem"  to  reconcile  signals  from  redundant  guidance  computers  or  gyros,  failure  of 
the  "voting"  device  can  disable  all  redundant  channels  simultaneously.  Further, 
the  simplest  form  of  numerical  redundancy  (replicating  identical  devices)  risks 
common-mode  failure,  as  we  mention  below:  any  number  of  supposedly  redundant 
diesel  generators  can  be  disabled  by  identical  design  or  maintenance  faults, 
contaminated  fuel,  etc.*  Replication  without  isolation  is  equally  imperfect. 
The  DC-10' s  multiple  hydraulic  cables  were  routed  parallel  to  each  other 
throughout  the  aircraft,  so  that  a  single  event  (the  collapse  of  the  cabin  floor 
when  an  open  cargo  door  depressurized  the  hold  in  the  Paris  crash)  could  cut  all 
the  lines  and  thus  disable  the  whole  plane's  hydraulic  control  system. 

Functional  redundancy,  as  John  von  Neumann  christened  it,  addresses  these 
problems  by  carrying  out  a  given  function  "in  parallel  by  a  number  of  function¬ 
ally  identical  but  physically  very  different  subsystems.  A  specific  example 
would  be  coupling  inertial  guidance,  fluidic,  and  electronic  subsystems  into  the 
guidance  system  of  a  missile.  Destruction  of  the  electronic  components  by  a 
nearby  intense  radiation  field  would  not  damage  the  purely  mechanical  compon¬ 
ents,  permitting  the  function  to  continue.  Although  this  example  is  not  a  happy 
one  to  contemplate,  it  demonstrates  [that]  where  systems  are  considered  by  their 
designers  to  have  to  succeed  in  the  face  of  multiple  assaults,  techniques  for 
creating  a  high  degree  of  resilience  have  been  used."  [Weingart  1977:29) 

It  is  on  the  principle  of  functional  redundancy  that  nuclear  reactors  shut 
down  if  any  of  several  signals  is  abnormal  (e.g.  neutron  flux,  temperature,  or 
period);  but  translating  that  shutdown  command  into  action  may  fail  for  lack  of 
diversity.  Most  reactor  shutdown  systems  in  the  U.S.  rely  on  continued  elec¬ 
trical  supplies  from  the  plant  busses.  In  contrast,  British  practice  favors 
many  functionally  redundant  shutdown  devices,  relying  perhaps  on  centrally 
powered  electrical  devices  in  one  case,  local  battery  power  in  another,  gravity 
or  springs  in  another,  and  local  compressed-air  bottles  in  yet  another.  This 
diversity  is  sought  quite  deliberately,  on  the  principle  that  one's  inability  to 
think  of  a  failure  mode  for  a  particular  system  does  not  mean  the  system  cannot 
come  up  with  one,  so  having  systems  as  different  as  possible  may  help  in  some 
unforeseen  way  to  protect  against  common-mode  failure*.  Likewise,  an  important 


*Strictly  speaking,  common-mode  failures  can  be  distinguished  from  common- 
cause  failures  [Solomon  &  Salem  1980].  The  former  refer  to  the  failure  of  iden¬ 
tical,  numerically  redundant  components  in  the  same  way,  while  the  latter  refers 
to  a  failure  of  functionally  redundant  systems  from  a  common  initiating  event . 
Although  our  argument  does  not  depend  on  this  sometimes  forced  distinction,  both 
kinds  of  failures  tend  in,  say,  reactor  accidents  to  be  more  important  than 
random,  sequential  failures  of  single  components.  Common-mode  failures  need  not 
be  purely  technological:  the  same  political  trends  could  simultaneously  prevent 
Western  coal,  oil-shale,  synfuel,  power-plant,  water,  and  uranium  projects. 
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strand  of  the  nuclear  safety  debate  concerns  the  ways  in  which  functional  inde¬ 
pendence  can  be  compromi sed  by  links  between  primary  and  backup  systems.  West- 
inghouse  re-- -tors,  for  example,  comnonly  activate  safety  systems  with  the  same 
signals  thai  control  normal  operating  systems.  This  link  has  on  occasion  pre¬ 
vented  both  systems  from  working — leading  a  senior  NRC  advisor,  Dr.  Stephen 
Hanauer,  to  note,  "West inghouse  thinks  this  [interconnection]  is  great  [because 
it  saves  them  money].  I  think  it  is  unsafe.  This  has  been  going  on  for  years." 

If  badly  done,  functional  redundancy  can  appear  to  be  an  operational 
nuisance.  In  graphite-moderated  reactors,  for  example,  some  types  of  accidents 
might  distort  the  core  so  that  control  rods  can  no  longer  be  fully  inserted.  In 
the  newer  British  reactors,  an  emergency  shutdown  system  known  as  the  "0  Jesus" 
system  is  therefore  provided  to  blow  boron  dust  into  the  core  with  pneumatic 
hoses;  this  would  require  that  the  reactor  be  written  off,  but  at  least  would 
ensure  shutdown.  Coupling  up  the  hoses  takes  long  enough  that  it  cannot  be  done 
thoughtlessly  or  acc' lentally .  In  contrast,  the  Fort  St.  Vrain  reactor  in 
Colorado  uses  instead  hoppers  of  boronated  steel  balls  which  fall  down  into 
holes  in  the  moderator  if  the  current  to  magnetic  latches  is  interrupted.  An 
accidental  activation  of  this  system  left  the  operators  spending  reportedly  the 
best  part  of  a  year  vacuuming  the  balls  out  again.  The  principle — ability  to 
shut  down  by  other  means  if  mechanical  rod  insertion  failed — was  sound;  but 
because  its  execution  was  flawed,  it  gave  the  principle  a  bad  name. 

Examples  of  more  successful  technical  diversity  abound.  In  emergency 
broadcasting  and  telephone  facilities,  for  example,  diesel  generators  are 
commonly  backed  up  not  by  other  diesels  but  by  batteries.  In  nuclear  warheads, 
functionally  redundant  proximity  and  barometric  fuses  are  backed  up  by  a  simple 
salvage  fuse  to  ensure  detonation  on  hitting  the  ground.  Diversity  need  not  be 
purely  technological:  entering  Minuteman  silos  requires  combinations  held  by 
both  the  security  ana  maintenance  staff,  but  many  of  the  security  staff  are 
Oriental  in  order  to  make  apparent  any  unauthorized  association  with  the  main¬ 
tenance  crews,  who  are  mostly  Caucasian.  Conspiracies  for  unauthorized  entry 
thus  become  more  difficult  and  conspicuous  to  arrange. 

Diversity,  properly  established,  enables  a  system  to  work  even  without 
unique  skills,  materials,  institutions,  fuels,  etc.  which  it  would  normally 
need,  because  some  backup  element  can  do  the  same  task  without  that  input.  If  a 
spare  part  is  not  available  for  a  diesel,  the  batteries  can  take  over  meanwhile. 
On  the  other  hand,  diversity  may  complicate  support  logistics  by  requiring  a 
wide  range  of  small-volume  inputs  for  normal  operation  and  maintenance:  one  must 
provide  not  only  diesel  parts  and  fuel  but  also  battery  acid  and  spare  plates. 
Only  technical  simplicity  (see  below)  helps  to  reduce  this  burden. 
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Interconnect  ions  between  energy  sources  and  users  provide  a  rich  menu  of 
advantages  and  dilemmas.  On  the  one  hand,  interconnections  essential  to  a 
system's  operation  can  actually  propagate  its  collapse  (as  in  the  electric  grid 
failures  we  reviewed  earlier).  On  the  other  hand,  interconnections  can  ' '  vent 
collapse,  bring  help  later,  or  enable  one  source  to  back  up  another  (as  m  .he 
wheeling  of  coal  power  to  oil-short  areas*).  At  the  best  of  times,  interconnec¬ 
tions  require  continuous  and  meticulous  management,  especially  in  synchronized 
electrical  grids  [Subcommittee  on  Energy  &  Power  1977:116-117].  The  ideal  kind 
of  interconnection,  as  our  Finnish  example  on  page  52  suggested,  is  an  opt i onal 
one  which  permits  the  reliability  and  economic  advantages  of  grid  connection  but 
which  also  permits  local  units  to  isolate  from  the  grid  at  need  and  continue  to 
power  their  local  service  areas  (p.  156  below). 

Studies  of  the  vulnerability  of  electric  grids  [e.g.  Lambert  &  Minor  1975] 
show  the  virtue  of  a  rich  topology  of  interconnections  and  of  avoiding  big, 
"lumpy"  nodes — points  of  either  supply  or  interconnection — which  would  tend  to 
concentrate  the  probability  and  consequences  of  failure.  That  is,  a  number  of 
energy  sources  that  can  route  their  output  via  many  different  paths  of  roughly 
equivalent  capacity,  diffusing  the  risk  rather  than  relying  unduly  on  particular 
sources  or  conduits,  can  usually  deliver  it  somehow  to  where  it  is  needed.  Many 
U.S.  electric  transmission  and  distribution  systems  lack  this  property:  their 
interconnections  are  too  sparse  or  their  capacity  is  too  "lumpy"  (undistributed) 
to  spread  the  risk.  In  contrast,  battleship  designers,  knowing  that  parts  of 
the  ship  may  be  damaged  in  a  battle,  ensure  that  multiple  electric  busses  loca¬ 
ted  in  different  parts  of  the  ship,  and  each  with  extra  capacity,  can  be  hooked 
up  in  many  different  permutations  to  improvise  continued  supplies. 

The  Bell  System  provides  a  useful  analogy  here.  Telephone  trunk  transmis¬ 
sion  is  very  highly  interconnected;  long-distance  calls  are  commonly  rerouted, 
even  several  times  a  second,  without  the  caller's  noticing.  Loss  of  a  particu¬ 
lar  microwave,  satellite,  or  cable  link  can  generally  be  compensated  by  use  of 
others.  But  on  closer  examination,  as  "phone  phreaks"  are  discovering,  this 
flexibility  of  rerouting  calls  actually  depends  on  a  relatively  small  number  of 
key  switching  points.  By  tying  up  all  the  input  ports  at  these  points,  a  small 
group  of  knowledgeable  people  could  crash  the  Bell  System.  It  is  indeed  the 
very  openness  of  the  telephone  network,  allowing  ready  access  from  innumerable 
points,  that  helps  to  cause  this  vulnerability  (to  say  nothing  of  allowing  the 
KGB  to  intercept  essentially  all  transcontinental  phone  traffic).  Most  people 
are  aware  of  the  peculiar  vulnerabilities  of  the  phone  system  only  if  their  own 
call  happens  to  be  cut  off  by  sotre  mishap — perhaps  that  a  tone  in  their  voice 
was  too  close  to  the  frequencies  used  to  signal  for  cutoff — but  all  they 

*And  vice  versa:  15  TW-h  was  imported  in  the  1977-78  coal  strike  [NERC  1979:7]. 
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normally  lose  is  their  own  call,  not  everyone's  at  once.  Yet  as  able,  computer- 
equipped  "commun i cat i ons  hobbyists"  probe  these  vulnerabi 1 i t ies ,  out  of  malice 
or  mere  curiosity,  we  may  all  become  more  aware  that  the  routing  flexibility  of 
the  Bell  System  is  not  as  invulnerable  as  it  looks.  It  is  an  open  question 
whether  the  apparent  flexibility  of  routing  in  major  electric  grids  is  equally 
vulnerable  to  disruption  of  a  few  key  nodes.  Although  some  observers  think  not 
[e.g.  Joint  Committee  on  Defense  Production  1977a : 72-73 , 1 16- 1 1 7 ]  ,  it  is  not 
clear  that  they  have  thought  very  hard  about  it. 

Related  to  functional  redundancy,  and  often  reliant  on  interconnection,  is 
the  property  of  functional  flexibility.  The  human  body  provides  numerically 
redundant  kidneys,  lungs,  etc.,  plus  considerable  spare  capacity  in  the  liver 
and  heart,  but  there  is  only  one  spleen.  No  matter:  if  the  spleen  is  lost, 
certain  structures  in  the  liver  are  sufficiently  similar  that  the  liver  can 
gradually  take  over  the  spleen's  essential  functions  [Altman  1980].  That  is, 
although  not  meant  to  be  a  spleen,  the  liver  is  designed  to  pinch-hit  for  it. 
This  is  the  concept  behind  the  Swedish  requirement  that  new  boilers  be  able  to 
accept  solid  fuel  (coal,  wood,  etc.)  and  the  recent  Swedish  government  discus¬ 
sions  on  whether  to  stockpile  wood  gasifiers  for  emergency  operation  of  cars — a 
highly  developed  art  that  ran  a  million  motor  vehicles  during  World  War  II. 

Not  content  with  requiring  boiler  operators  and  other  principal  energy  users  to 
maintain  private  stockpiles  amounting  in  practice  to  about  0.8  years'  fuel 
supply,  the  Swedish  government  is  already  thinking  about  pinch-hitting  technolo¬ 
gies.  The  same  principle  presumably  guides  U.S.  planners'  Multi-Fuel  Program  to 
make  military  vehicles  adaptable  to  a  wider  range  of  emergency  fuel  supplies — a 
flexibility  the  Third  Reich  found  essential,  equipping  by  March  1944  more  than 
80%  of  large  vehicles  to  burn  alternative  liquid,  gaseous,  and  solid  fuels 
[Energy  &  Defense  Project  1980:23).  Such  flexibility  can  apply  to  both  energy 
supply  and  demand,  and  Chapter  6  will  illustrate  how  more  efficient  energy  use 
can  make  improvised  supplies  vastly  more  useful. 

Modular i ty  and  standard i zat ion  are  double-edged  properties:  on  the  one 
hand,  the  ability  to  plug  in  common  replacement  parts  can  make  equipment  far 
more  maintainable,  but  on  the  other,  if  the  modules  happen  to  incorporate  a 
design  or  manufacturing  flaw,  that  flaw  is  then  plugged  in  universally — as  has 
occurred  with  certain  automobile  spare  parts.  Special  care  is  thus  essential 
(if  not  always  sufficient)  to  prevent  the  propagation,  by  a  well-meant  program 
of  standardization,  of  proneness  to  common-mode  failures. 

A  technology  which  comes  in  relatively  small  constituent  blocks  is  flexible 
in  size  and  often  in  function  and  location.  It  is  more  portable,  more  easily 
cannibalized  and  transferred,  easier  to  experiment  with.  It  is  also  likely  to 
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be  more  maintainable.  (Maintainability  is  not  the  same  thing  as  being  super¬ 
reliable  an  essential  property  where  failure  is  intolerable,  but  not  an  ideal 
property  because  it  means  that  failures  are  so  infrequent  that  people  may  not 
have  enough  hands-on  retiair  experience  to  be  able  to  fix  them  properly.) 

Internal  decoupling  and  buffering  is  an  essential  feature  of  resilient 
systems.  It  means  that  their  parts  should  be  only  loosely  coupled  in  time  and 
space,  so  that  the  failure  of  one  does  not  immediately  disable  others.  An  oil 
refinery,  for  example,  which  has  very  small  storage  tanks  in  between  its  stages 
has  no  operational  flexibility:  if  all  stages  do  not  work  exactly  at  the  rate 
and  in  the  manner  planned,  products  will  be  too  scarce  at  some  points  and  too 
plentiful  at  others.  If  one  stage  fails,  there  will  also  be  no  way  to  bypass  it 
and  no  "breathing  space”  of  time  in  which  to  improvise  repairs,  so  the  whole 
plant  will  have  to  be  shut  down  [Stephens  1970 : 105  ;  1973 : 1  12 ,34 ]  .  This  principle 
is  well-known  to  chemical  process  designers,  but  not  always  observed:  one  of  the 
reasons  the  G.E.  reprocessing  plant  at  Morris,  Illinois  had  to  be  written  off  as 
inoperable  was  that  it  was  too  tightly  coupled  to  allow  for  normal  operational 
variations  among  its  sequential  stages.  The  general  principle  of  stretching  the 
time  constants  of  a  system — leaving  "slop"  between  its  stages  to  allow  rerout¬ 
ing,  modification,  and  repair — is  considered  further  in  Chapter  6.  Meanwhile,  it 
is  important  to  note  that  if  the  storage  of  fuels  or  energy  can  be  dispersed  and 
located  near  the  end-users,  it  provides  them  with  a  long  time  constant  in  case 
they  are  interrupted.  Similar  considerations  apply  in  non-energy  industrial 
systems:  the  British  auto  industry,  for  example,  holds  only  small  buffer  stocks 
of  steel  (for  "e f f ic iency" )  and  so  is  rapidly  halted  by  steel  strikes. 

Another  desirable  technical  feature  of  energy  systems  and  components  is 
s impl ic ity .  Experienced  engineers  have  long  worked  by  the  KISS  principle  ("keep 
it  simple,  stupid")  and  the  Fathy  principle  ("Don't  try  to  improve  on  anything 
that  works");  but  some  engineers  are  tempted  to  forget  the  truism  that  the  fewer 
components  there  are,  the  less  there  is  to  go  wrong.  Boe ing-Vertol 1 s  first 
design  for  a  door  for  Boston  subway  cars  had  1300  parts,  later  reduced  to  300: 
the  designers  were  so  sophisticated  that  they  couldn't  design  a  door  any  more. 
(They  also  showed  their  over soph ist icat ion  by  designing  a  floor  whose  rigidity 
would  have  been  ample  on  an  airplane,  with  passengers  sitting  neatly  in  rows; 
unfortunately,  subway  riders  cluster  at  the  doors  on  arriving  at  a  station,  and 
this  redistribution  of  weight  so  bowed  the  floors  that  the  doors  jammed  shut.) 

Simple  mathematics  requires  that  very  elaborate  systems  break  down  often. 

A  system  whose  operation  depends  on  10  components,  each  of  which  works  99%  of 
the  time,  will  be  out  of  action  10%  of  the  time;  with  100  such  components,  63% 
of  the  time;  with  1000,  99.9957%  of  the  time,  so  it  will  work  only  23  minutes 
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per  year.  The  Navy's  MK-86  fire  control  system,  used  on  the  most  advanced  com¬ 
bat  ships,  doesn't  work  about  40%  of  the  time — partly  because  it  has  over  40,000 
components.  (Not  surprisingly,  it  is  proving  very  difficult  to  stock  enough 
spare  parts  and  train  the  repair  personnel.)  [Comptroller  General  of  the  U.S. 
1981:6]  To  be  96%  reliable,  a  system  whose  operation  depends  on  each  of  40,000 
components  must  have  an  average  component  reliability  of  1  failure  in  a  million. 
The  MK-86' s  average  component  reliability  is  apparently  some  ten  times  worse. 

If  the  potential  for  common-mode  failures  is  somehow  related  to  the  number 
of  possible  interactions  between  any  two  components,  and  if  those  interactions 
can  be  of  only  one  kind,  then  the  nunber  of  interactions  among  n  components  is 
ri(t^-l)/2 — or,  for  40,000  components,  some  800  million.  But  if  interactions  can 
be  between  more  than  two  components,  or  of  more  than  one  kind,  then  the  nunber 
of  interactions  rapidly  becomes  astronomical*. 

In  the  face  of  such  discouraging  mathematics,  resilience  requires  that 
nothing  important  depend  ab  sol utel y  on  anything  complicated  unless  its  complex¬ 
ity  is  very  thoughtfully  organizedt:  the  price  of  failure  can  simply  be  too 
high.  When  the  sophisticated  MK-86  fire-control  system  works,  it  can  simultan¬ 
eously  track  and  destroy  multiple  incoming  missiles.  But  when  it  fails  (i.e. 

40%  of  the  time),  "the  ship  is  virtually  d  fenseless"  [jji .  ]  and  can  be  destroyed 
by  a  single  shot.  A  more  brittle  design  can  hardly  be  imagined.  Sometimes, 
however,  there  is  a  better  choice.  Some  years  ago,  there  was  reportedly  a  de¬ 
bate  in  the  Pentagon  about  which  of  two  control  designs  to  buy  for  a  major  mis¬ 
sile  system:  a  rigidly  hierarchical  one  which  worked  only  if  all  its  subsystems 
worked,  or  one  with  less  monolithic  architecture,  designed  so  that  it  would  work 
even  if  about  a  third  of  its  subsystems  were  out  of  action.  The  former  was  se¬ 
lected  because  it  looked  about  10%  cheaper.  (In  the  event,  the  missile  was  not 
built  anyway.)  Today,  after  more  experience  of  unreliable  weapons  systems 
[Fallows  1981],  the  decision  could  well  be  different. 

A  desirable  property  well-known  to  designers,  but  hard  to  characterize 
formally,  is  forgivingness .  Although,  as  Edward  Teller  remarks,  no  foolproof 
system  is  proof  against  a  sufficiently  great  fool,  a  "forgiving"  system  at  least 
tolerates  the  ordinary  run  of  foolishness.  A  "forgiving"  design  is  simple  and 
robust  enough  to  tolerate  mistakes  and  variations  in  design  and  manufacturing; 


*Power  reactors  have  already  reached  this  stage:  safety  systems  sometimes 
interfere  with  each  other  or  even  initiate  accidents  by  their  unforeseen  inter¬ 
actions.  The  limits  of  tolerable  complexity  may,  in  the  view  of  some  thought¬ 
ful  analysts  of  nuclear  safety,  have  been  reached  and  exceeded:  simpler  systems 
cannot  do  the  job  (at  least  given  the  types  and  sizes  of  reactors  now  in  use) 
while  complicated  ones  can  behave  in  ways  beyond  our  ability  to  predict. 
tEven  complex  systems  can  be  reliable  and  resilient  if  their  many  components 
are  organized  "in  such  a  way  that  the  reliability  of  the  whole... is  greater 
than  the  reliability  of  its  parts"  [von  Neumann  1956],  e.g.  via  decentralized 
control  systems  acting  in  parallel  [Siljak  1978;  Barlow  &  Proschan  1975]. 


it  way  also  isolate  or  limit  the  effects  of  failure.  An  "unforgiving"  design 
pushes  materials  and  components  so  near  their  limits  of  performance  that  any 
deviation  from  expected  perfection  leads  to  serious  failure.  The  collapse  of 
many  box-girder  bridges  (a  style  of  construction  once  popular  in  Britain)  has 
been  traced  [Stewart  1975:450],  using  catastrophe  theory,  to  the  use  of  design 
techniques  and  structures  (stiffened  panels)  which  "are  maximally  sensitive  to 
imperfections  in  their  manufacture":  their  buckling  behavior  is  such  that  even 
slight  deviations  "can  reduce  the  strength  to  around  two-thirds  of  the  theoreti¬ 
cal  maximum."  Result:  several  deaths  and  hundreds  of  million  dollars'  damage. 

A  bridge  design  that  had  large  safety  margins  because  of  the  shape  of  the 
components — not  just  the  plentiful  use  of  materials — or  that  was  so  designed 
that  failure  could  not  propagate  from  one  part  to  another  would  be  inherently 
"forgiving."  In  this  sense,  a  typical  LNG  tanker  is  an  "unforgiving"  design 
because  one  breach  of  the  LNG  containment  membrane  may  lead  to  failure  of  the 
entire  hull.  A  low-power-density,  high-thermal-mass  nuclear  reactor  whose 
nuclear  reaction  is  damped  by  higher  temperatures  is  more  "forgiving"  than  one 
which  has  the  opposite  properties  and  therefore  allows  only  a  short  time  to 
correct  deviations.  An  aircraft  that  can  land  safely  with  all  engines  out  is 
more  "forgiving"  than  one  that  cannot .  A  spacecraft  that  can  be  safely  navigat¬ 
ed  and  landed  without  its  guidance  equipment,  even  by  the  use  of  such  old-fash¬ 
ioned  equipment  as  a  sextant,  is  more  "forgiving"  than  one  whose  survival 
depends  on  its  electronics  [Cooper  1973]. 

It  should  go  without  saying  that  energy  systems  are  more  resilient  if  they 
rely  on  sustainable,  renewable  energy  flows  not  subject  to  depletion  or  delib¬ 
erate  interruption.  It  is  perhaps  less  obvious  that  such  systems  should  also  be 
reproducible  without  elaborate  resources.  A  nuclear  power  reactor  is  not  only 
among  humankind's  most  complex  technological  achievements;  it  also  depends  for 
its  construction  and  its  continued  maintenance  on  a  pool  of  highly  specialized 
skills,  processes,  and  materials.  If  there  is  no  longer  enough  business  to  keep 
those  resources  employed,  well-trained,  well-motivated,  and  continuously  re¬ 
cruited  at  a  high  level  of  talent — as  appears  to  be  the  prospect  for  the  nuclear 
industry  over  the  coming  decades — safety  and  maintainabi 1 ity  may  decline.  Con¬ 
versely,  a  wind  machine  simple  enough  to  made  in  any  vocational  school  shop,  and 
which  will  run  without  maintenance  for  twenty  or  thirty  years,  is  a  sufficiently 
"vernacular"  technology* to  be  accessible  to  a  wide  range  of  people  and  operable 
even  under  highly  disrupted  conditions.  Later  Chapters  will  explore  further  the 
availability  of  such  simple,  readily  buildable  and  operable  technologies,  and 
the  contribution  they  can  make  to  energy  preparedness  if  necessary  information, 
skills,  and  materials  are  properly  dispersed  and  stockpiled. 

*This  phrase  is  due  to  Illich  [1980]. 
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A  technical  feature  conducive  to  resilience,  though  seldom  considered  in 
this  regard,  is  capacity  for  rapid  evolution.  Biological  succession,  including 
that  of  dinosaurs  by  small  mammals,  has  depended  on  the  rapid  exchange  of  gene¬ 
tic  information,  trial  of  new  designs,  and  feedback  from  environmental  experi¬ 
ence  to  improve  those  designs.  (While  not  rapid  on  a  human  time-scale,  these 
changes  were  often  very  rapid  on  a  geological  time-scale.)  Likewise,  if  one 
energy  technology  can  undergo  many  generations  of  development  in  the  time  it 
takes  to  build  one  prototype  for  another  technology,  the  former  is  likely  to 
achieve  efficient  designs  sooner  and  at  much  lower  risk  of  failure.  The  latter 
may  reach  commercialization  only  by  so  compressing  its  development  sequence  that 
the  design  of  each  scaling-up  must  be  frozen  before  operating  experience  has 
been  gained  with  its  predecessor  las  with  reactor  and  synfuel  programs). 

Accessibil ity  to  a  wide  variety  of  contributors  to  this  design  process — a 
signal  feature  of  many  small  renewable  sources — further  speeds  up  evolution. 

Many  of  the  best  ideas  in  renewable  energy  technologies  are  coming  today  from 
people  with  little  or  no  technical  background.  We  recently  received  a  letter, 
for  example,  from  a  homesteader  in  a  remote  part  of  Alaska — a  man  with  at  best 
a  grade-school  education — who  had  invented  some  novel  and  useful  solar  and  wind 
systems  to  meet  his  own  needs.  On  discovering  that  his  biogas  digester  would 
handle  normal  organic  wastes  but  disliked  paper,  he  noticed  a  moose  eating  a 
willow  tree,  seeded  his  digester  with  moose  gut,  and  reported  that  his  digester 
would  now  happily  digest  paper  and  even  sizeable  chunks  of  wood.  Thus  he  has 
found  something  quite  important,  even  though  he  is  not  Exxon. 

Social  compatibility — a  happy  relationship  between  the  technical  and  social 
systems — is  also  important  to  resilience.  For  example,  an  energy  system  which 
equitably  allocates  energy  and  its  social  costs  to  the  same  people  at  the  same 
time,  so  they  can  decide  for  themselves  how  much  is  enough,  is  less  likely  to 
become  embroiled  in  "energy  wars"  than  a  centralized,  inequitable  system  (page 
26).  An  energy  system  whose  impacts  are  understandable,  directly  sensible 
(rather  than  invisibly  threatening),  and  perceived  to  be  benign  and  controllable 
is  more  likely  to  be  socially  acceptable  than  one  lacking  these  qualities.  Tech¬ 
nical  properties,  then,  strongly  affect  the  ease  of  democratic  implementation. 

As  Hoover  remarks  [1979:24],  an  energy  system  should  be  "socially  stable," 
requiring  "a  minimum  of  social  control.  It  should  not  be  necessary  to  deploy 
force  to  protect  [if].... The  system  should  be  able  to  survive  and  recover  from 
periods  of  political  breakdown,  civil  unrest,  war  and  acts  of  terrorism.  The 
system  should  be  unlikely  to  become  a  target  of  protest;  should  enhance,  not 
threaten  social  stability.”  It  should  defuse,  not  generate,  tensions  and  ine¬ 
quities.  For  greatest  efficiency  and  adaptability  in  deployment,  some  observers 
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would  argue  that  it  should  ideally  propagated  more  by  networks  than  by 
inflexible  hierarchies,  as  the  former  appear  to  be  a  more  quickly  responding 
form  of  social  organization  [Gerlach  10/9]. 

4.5.  Analogous  universes. 

We  have  already  referred  to  certain  design  examples  from  such  areas  as 
civil  aviation,  military  hardware,  nuclear  reactors,  and  telecommunications 
systems.  Our  readings  and  discussions  in  these  and  other  technical  areas  have 
revealed  that  only  a  handful  of  people  seek  consciously  to  apply  such  design 
principles  as  we  have  just  summarized.  Far  more  commonly,  if  resilience  is 
achieved,  it  is  by  accident  in  the  pursuit  of  other  goals.  Design  philosophy  is 
normally  centered  around  satisfying  narrowly  conceived  regulations  (for,  say, 
reactors)  or  performance/cost/t ime  specifications  rather  than  producing  an 
inherently  resilient  product.  Even  the  electric  utilities  that  have  thought 
most  deeply  about  resilience  agree  that  such  resilience  as  their  grids  possess 
is  a  side-effect  of  other  design  considerations  (e.g.  against  earthquakes),  not 
"designed  in."  Military  hardware  is  normally  designed  only  to  cope  with  speci¬ 
fic  operational  threats  that  can  be  foreseen  and  quantified,  not  with  unforesee¬ 
able  ones,  and  resilience,  if  achieved  at  all,  is  purely  accidental.  In  both 
civil  and  military  hardware,  efforts  to  increase  resilience  are  only  (as  one 
Pentagon  analyst  put  it)  a  "hysterical  realization  after  the  fact" — that  is, 
design  precautions  taken  against  the  previous  failure.  Indeed,  those  precau¬ 
tions  are  often  applied  only  to  future  designs,  not  retrofitted,  because  of  cost 
and  inconvenience  (or  pure  inertia:  the  NRC  is  currently  fining  TVA  $50,000  for 
still  not  having  taken  basic  fire  precautions  at  Browns  Ferry,  six  years  after 
its  near-disastrous  fire). 

,  has 

Are  there  technical  fields  in  which  the  need  for  resi l  ience^already  been  so 
clearly  perceived  that  it  has  resulted  in  a  coherent,  readily  identifiable  deci¬ 
sion  to  change  the  architecture  of  an  evolving  technical  system?  Data  proces¬ 
sing  offers  such  an  example,  and  its  lessons  have  strong  parallels  to  a  desir¬ 
able  direction  for  the  evolution  of  the  energy  system. 

The  past  decade  has  seen  a  wide-ranging  professional  debate  about  whether 
data  processing  should  become  more  dispersed  ("distributed")  or  more  central¬ 
ized.  As  microprocessors  have  packed  more  performance  into  cheaper  chips — al¬ 
ready  more  complex  than  human  microcircuit  designers  can  handle  [Shaffer  1981) 

— the  cost  of  executing  an  instruction  on  a  large  mainframe  computer  has  come  to 
be  equal  to  or  larger  than  that  of  doing  the  same  thing  on  an  office  microcom¬ 
puter.  But  the  centralized  computers  were  meanwhile  proving  disagreeably 


155 


"brittle."  When  they  broke  down,  whole  corporations,  including  time-sensitive 
ones  such  as  banks  and  airlines,  could  be  paralyzed.  Mainframe  computers  were 
harder  to  understand  and  repair  than  small  systems.  Modifications  were  pain¬ 
fully  slow.  Since  no  "average  user"  exists,  all  users  were  in  some  degree 
unhappy  with  the  central  computer's  match  to  their  own  needs.  Such  forces  led 
Citibank,  Bank  of  America,  and  a  host  of  other  major  computer  users  to  seek  as 
dispersed  a  computer  network  as  they  could  reasonably  achieve.  IBM's  computer 
marketing  strategy,  about  a  decade  ago,  was  changed  to  emphasize  more  dispersed 
systems  that  could  fail  more  gracefully.  "Distributed  processing"  is  now 
accepted  as  the  wave  of  the  future — the  hottest  concept  in  system  design. 

A  closer  look  at  this  history  is  revealing.  One  review  [Drexhage  & 

Whi t ing-O' Keefe  1976:1]  explains: 

During  the  1960s,  there  was  a  general  thrust  toward  centralizing  all  the 
data  processing  within  an  organization  in  the  hope  that  this  approach  would 
serve  all  users.  In  fact,  it  did  not  serve  either  the  central  data 
processing  staff  or  dispersed  users  as  well  as  was  expected ...[ and  attempts 
at  a  remedy]  resulted  in  many  disappointments  as  well  as  some  conceptual 
misdirections  in  the  development  of  management  information  systems.... 

The  solution,  it  now  appears,  may  be  decentralization.  In  the  past  few 
years,  advances  in ...  technology .. .have  made  networks  of  interconnected 
minicomputers  a  plausible  alternative  to  centrally  oriented  operations.  At 
the  same  tiome,  pressure  from  dissatisfied  users  of  central  systems  has 
speeded  the  trend  toward  decentral ization. ... [Distributed  processing  meets] 
an  important  need  for  more  functionally  oriented,  more  manageable,  and  more 
flexible  approaches  to  data  processing  problems. 

The  risk  of  large-scale  failure  or  disruption  was  on  the  designers'  minds,  just 
as  it  is  now  emerging  as  an  issue  in  energy  systems.  As  some  15  bombings  in  10 
months  blasted  French  computer  facilities  [Kessler  1981],  the  first  internation¬ 
al  symposium  on  computer  security  [Murray  1981]  heard  an  American  expert  "who 
has  so  far  succeeded  in  classifying  800  types  of  computer  crime"  warn  that 
"within  10  years  the  real  threat  to  world  stability  would  not  be  nuclear  [war] 
...but  the  ability  of  one  nation  to  enslave  another  by  paralyzing  its  computers. 
...[In]  West  Germany ,.. .an  operator  had  succeeded  in  stealing  22  magnetic  bands 
[disks  or  tapes]  essential  for  the  operation  of  a  large  chemical  group.  The 
board  hesitated  only  briefly  before  handing  over  $200,000  ransom  to  recover 
[ them] ... .Many  banks  are  even  more  vulnerable ... .Were  a  big  bank  to  be  affected 
...there  would  be  inevitable  and  serious  repercussions  on  the  economy  of  the 
country  where  it  was  based."  In  1979  alone,  633  cases  of  computer  crime  were 
discovered  (472  of  them  in  the  U.S.),  and  the  current  cost  of  those  just  in 
Europe  is  estimated  at  over  $3  billion  per  year.  The  "average  holdup  of  a 
computer  brings  the  white-collar  criminal  a  profit  of  $500,000  compared  with 
only  $10,000  for  the  traditional  armed  holdup."  Central  computers  are  vulner¬ 
able  even  to  natural  disaster:  a  major  California  earthquake  could  make  Visa® 
and  Mastercharge®  collapse  if  computing  were  not  restored  within  a  few  days. 
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Another  worry  is  that  in  a  large  computer  system  "it  is  virtually  impossible  for 
a  user  to  control  access  to  his  files"  and  to  prevent  "subversion  of  software 
structures"  (i.e.  unauthorized  alteration  of  stored  programs  for  purposes  of 
embezzlement,  espionage,  or  extortion)  (Lorin  1979:595],  Smaller  computers  can 
confine  by  hardware  segregation  the  amount  and  sensitivity  of  information  that 
can  be  stolen  or  altered,  leading  to  a  major  improvement  in  protection  of  both 
corporate  interests  and  individual  privacy  [Drexhage  &  Whi t ing-O'Keefe  1976:5], 

Of  even  more  immediate  concern  to  computer  users  is  that 

...downtime  may  balloon  to  hinder  the  company's  day-to-day  operations.  For 
example,  one  system  'crash'  may  result  in  a  hour  of  downtime  during  which 
the  problem  is  analyzed;  perhaps  another  hour  is  lost  while  operations  are 
restored;  and  finally,  there  is  an  adjustment  phase  during  which  time  the 
system  again  reaches  stable  on-line  operations.  All  of  these  delays  have 
significant,  and  at  times  disastrous,  impacts  on  corporate  operations.... 

Attempts  to  minimize  this  problem  have  been  only  marginally  successful. 
...Large  monolithic  systems  still  tend  to  be  unwieldy. 

Recent  attempts  to  confront  this  problem  include  a  new  approach  to  sys¬ 
tem  architecture.  New  [architectures  use] .. .many  processors  and  memory 
units  interlinked  by  high-speed  communications.  All  processor  units  are 
homologous  and  capable  of  replacing  each  other  in  case  of  failure  [i.e. 
they  are  numerically  and/or  functionally  redundant].  [ i d  . ; 6 ] 

Lorin  [1979:591]  identifies  similar  benefits: 

The  view  that  distributed  processing  can  provide  greater  reliability  [data 
accuracy]  or  availability  [working  when  wanted]  is  based  upon  the  economics 
of  replication  and  the  granularity  of  configurability  that  interconnected 
smaller  systems  may  provide.  The  duplexing  or  triplexing  of  small  proces¬ 
sors. ..is  quite  common ...[ and  is  attractive  because]  smal 1 . . .uni ts  are  in¬ 
expensive  and  additional  units  give  disproportionate  reliability  incre¬ 
ments,  while  adding  modestly  to  total  system  cost.... The  same  approach  is 
not  equally  well  applied  to  large  processing  nodes  because  of  the  larger 
prices  and  the  incremental  jump  in  total  system  cost  when  a  large  unit  is 
repl icated .... 

.  Gray  [1979:5]  summarizes: 

[Decentralization  may  have  a  positive  effect  on  both  availability  and 
reliability.  In  a  loosely  coupled  system,  the  failure  of  one  system  should 
not  affect  the  other  systems.  This  localization  of  failures  enhances  avail¬ 
ability.  Conversely,  by  replicating  data  and  programs,  systems  may  act  as 
backup  for  one  another  during  periods  of  maintenance  and  failure.  Lastly, 
decentralization  allows  for  modular  growth  of  the  system.  When  more  stor¬ 
age  or  processing  is  needed,  it  may  be  justified  and  added  in  small  [and 
relatively  cheap]  units. 

The  key  to  these  benefits — greater  security  against  disruption,  equivalent  or 
lower  cost  of  service,  more  reliable  routine  operation  [Alsberg  &  Day  1976; 

Lamport  1978],  greater  convenience  and  flexibility  to  the  user — is  "node  auto¬ 
nomy,"  the  ability  of  each  machine  to  serve  local  users  in  isolation  if  the 
communication  network  fails  [Katzman  1977;  Bartlett  1977;  Highleyman  1980;  Gray  1977 
Tandem  1981]  .  Both  this  design  principle  and  the  broader  philosophy  of  which  it 
is  a  part  have  striking  parallels  in  the  design  of  resilient  systems  for  supply¬ 
ing  energy.  We  next  draw  out  some  of  these  parallels  by  examining  scale,  dis¬ 
persion,  and  "granularity"  in  energy-supplying  technologies. 


157 


5.  SCALE  ISSUES 


The  previous  chapters  have  identified  many  respects  in  which  gigantic, 
highly  centralized  energy  systems  are  inherently  vulnerable,  and  suggested  many 
reasons  why  more  dispersed,  diverse,  redundant  systems  should  be  inherently 
more  resilient.  This  observation  invites  two  common  responses,  both  incorrect. 
The  first  is  that  contemplating  the  use  of  smaller,  less  centralized  energy 
technologies  is  really  a  covert  way  of  seeking  to  "decentralize  society" — to 
turn  cities  into  agrarian  villages.  Congress  into  town  meetings,  and  (by  a  fur¬ 
ther  emotive  extension)  modern  technology  into  primitivism.  We  must  immediate¬ 
ly  disabuse  the  reader  of  such  a  notion.  Throughout  our  published  analyses  we 
have  been  concerned  only,  as  we  are  here,  with  how  to  construct  an  energy  sys¬ 
tem  with  maximal  economic  and  national-security  benefits.  Discussion  of  what 
might  be  the  most  desirable  form  of  social  organization  is  far  beyond  our  scope 
here.  In  point  of  fact,  moreover,  neither  common  sense  nor  careful  study  of 
the  actual  institutional  impact  of  smaller  energy  technologies  [Messing  etal. 
1979]  supports  the  contention  that  smaller  energy  systems  entail  less  central¬ 
ized  patterns  of  settlement  or  governance:  such  technologies  actually  preserve 
a  complete  range  of  choice  in  social  and  political  scale.  The  confusion  arises 
from  sloppy  terminology  (which  Appendix  C  seeks  to  clarify)  and  from  some  advo¬ 
cates'  failure  to  distinguish  technical  conclusions  from  political  preferences. 

The  second  common  reaction  to  pointing  out  the  greater  resilience  of 
smaller  and  less  centralized  energy  systems  is  to  allege  that  although  this 
property  is  doubtless  desirable,  such  technologies  are  inordinately  costly  and 
slow,  and  are  in  any  case  inadequate  to  the  needs  of  a  modern  industrial  soci¬ 
ety.  This  objection,  unlike  the  first,  is  in  substantial  part  a  technical 
dispute  that  can  be  settled  on  technical  merits.  We  therefore  seek  in  this 
chapter  to  consider  the  economic  and  logistical  implications  of  scale — of  the 
size  of  individual  energy-convert ing  devices — and  in  Chapter  7  to  consider 
the  adequacy  and  cost  of  relatively  small-scale  energy  technologies. 

5.1.  Appropriate  scale. 

There  is  no  single  correct  size  for  pnergy-convert ing  devices  or  systems. 
The  optimal  size  depends  on  the  use.  There  is  no  data  base  anywhere  in  the 
world  which  shows  in  detail  the  spectrum  of  scales  and  spatial  densities  of 
end-use  energy  needs  for  a  particular  region — let  alone  the  thermodynamic  qual¬ 
ities  of  energy  required  and  how  those  are  correlated  with  scale  and  density. 


In  principle,  a  least-cost  energy  system  cannot  be  rigorously  designed  without 
such  data.  One  cannot  determine  the  best  way  to  do  a  task  without  knowing  what 
the  task  is. 

Simple  order-of-magni tude  estimates  nevertheless  suggest  that  the  scale  of 
modern  power  plants,  refineries,  proposed  synfuel  plants,  etc. — typically  1-10 
GWe  (10^  w)  —  is  much  larger  than  the  scale  of  most  end-uses.  The  heating 
or  cooling  load  of  inefficient  houses  is  typically  measured  in  10®  W;  the 
energy  needs  of  large  industrial  plants  range  from  pathological  maxima  of  the 
order  of  10^  W  to  normal  maxima  of  the  order  of  10®  W.  Most  end-use 
devices  used  in  production  are  clustered  in  factories  or  offices  using  less 
than  about  10®  W.  Most  end-use  devices  important  to  our  daily  lives  need 
of  the  order  of  10®  to  10®  W  and  are  clustered  in  living  or  working 
units  requiring  of  order  10®  to  10®  W.  Most  production  processes  of 
practical  interest  have  long  been  carried  on  in  units  of  the  order  of  10®  W 
or  less.  Is  this  enormous  mismatch  between  many  supply  technologies  and  most 
end-uses  actually  economically  advantageous? 

Doctrinaire  belief  in  economies  of  scale  has  long  dominated  energy  invest¬ 
ment  decisions.  It  made  the  capacity  of  the  largest  turbogenerators  double 
"every  6.5  years  through  five  orders  of  magnitude"  [Marchetti  1975];  this  tend¬ 
ed  to  increase  physical  central izat ion,  since  total  grid  capacity  doubled 
slightly  more  slowly  (about  every  7  years  until  the  1970s).  The  U.S.  energy 
industries,  and  especially  electric  utilities,  are  currently  investing  tens  of 
billions  of  dollars  per  year  in  facilities  of  10^-W  scale  on  the  assumption 
that  net  economies  of  large  scale  are  real  and  significant.  Yet  that  assumption 
has  astonishingly  sparse  support  from  up-to-date  empirical  data.  Official  stu¬ 
dies  seem  to  observe  almost  a  taboo  on  testing  dogma  against  data.  Many  stu¬ 
dies  which  were  supposed  to  assess  diseconomies  of  scale  largely  ignored  them 
[e.g.  Asbury  &  Webb  1979;  Economic  Regulatory  Administration  1981],  even  though 
the  second  of  those  studies  supposedly  responded  to  a  legal  mandate  (Public 
Utility  Regulatory  Policies  Act  of  1978,  S 209 )  to  assess  "cost  effectiveness  of 
small  versus  large  generation,  centralized  versus  decentralized  generation, 
and  intermittent  generation,  to  achieve  desired  levels  of  reliability." 

This  chapter  begins  to  remedy  that  omission  by  identifying  many  types  of 
diseconomies  of  large  scale  which  most  economic  assessments  of  energy  systems 
fail  to  include.  We  shall  show  that  in  today's  economic  circumstances,  and 
with  a  wider  awareness  of  what  is  economically  relevant,  "many  of  the  advanta¬ 
ges  claimed  for  large  scale  [in  energy  systems]  may  be  doubtful,  illusory, 
tautological,  or  outweighed  by  less  tangible  and  less  quantifiable  but  perhaps 
more  important  disadvantages  and  d i seconomi es"  [Lovins  1977:86). 
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In  principle,  an  optimal  scale  for  a  particular  application  could  be 
calculated  by  superimposing  all  known  economies  and  diseconomies  of  scale  and 
finding  the  minimum-cost  point  or  points  (there  may  well  be  more  than  one).  In 
practice,  no  theory  is  available  for  optimizing  unit  scale  with  respect  to  all 
these  properties.  Nobody  knows  what  the  composite  cost-vs .-scale  curve  would 
look  like  in  any  particular  case.  Many  neglected  diseconomies  are  clearly  so 
large,  however,  that  just  a  few  of  them  would  often  suffice  to  reverse 
traditional  scale  economies. 

To  make  this  tangled  subject  tractable,  we  must  exclude  from  our  analysis 
such  questions  as  the  appropriate  organ izat i onal  scale  of  energy  systems.  It 
is  important  for  some  purposes,  for  example,  to  know  that  of  the  roughly  3500 
U.S.  electric  utilities,  the  largest  10  own  about  252  of  the  total  capacity, 
the  largest  30  own  50%,  and  the  largest  100  own  80%  [Economic  Regulatory  Admin¬ 
istration  1980:Ex.Sum.8] .  (The  concentration  before  the  Depression  was  even 
greater:  eight  holding  companies  produced  75%  of  the  electricity  in  1932,  al¬ 
though  several  then  went  bankrupt  as  sales  declined  [Congressional  Research 
Service  1979:11].)  But  although  the  scale  and  nature  of  utility  ownership  un¬ 
doubtedly  affect  utility  economics  somehow,  we  shall  not  try  to  determine  how. 
We  shall  also  largely  ignore  sociopolitical  effects  of  scale  in  energy  systems 
(some  of  which  we  listed  in  Chapter  2.1),  because  while  they  are  undoubtedly 
important — some  would  say  dominant — in  the  way  the  United  States  actually  makes 
public  policy  decisions  about  energy,  nobody  knows  how  to  quantify  them. 

Our  analysis  must  also  be  understood  in  its  historical  context.  We  are 
not  arguing  that  decisions  to  build  large  plants  in  the  past  were  always  non¬ 
sensical;  rather  that  they  would  no  longer  be  economically  rational  in  today's 
quite  different  circumstances.  Nor  are  we  denying  that  there  are  often  real 
economies  of  scale  in  construction  costs  per  kW  installed;  only  pointing  out 
that  this  is  a  gross,  not  a  net,  economy,  and  must  be  tempered  by  other  effects 
which  at  large  scale  may  restrict  the  energy  delivered  from  each  installed  kW. 
That  is,  any  analysis  which  supposes  the  objective  is  to  install  capacity  rath¬ 
er  than  to  deliver  energy  services  is  fundamentally  misconceived.  Finally,  be¬ 
cause  electrical  supply  has  in  recent  years  accounted  for  two-thirds  or  more  of 
the  capital  invested  in  the  U.S.  energy  sector  and  in  Federal  energy  R&D,  and 
because  better  data  on  scale  effects  are  available  for  electric  than  for  other 
energy  systems,  our  examples  will  be  mainly  electrical,  even  though  this  form 
of  energy  accounts  for  only  12%  of  U.S.  delivered  energy  and  for  8%  of  current 
U.S.  delivered  energy  needs.  Similar  arguments  apply  to  other  energy  forms. 

Ever  since  the  world's  first  central  power  station  was  commissioned  in 
1882  at  Appleton,  Wisconsin,  the  scale  of  electrical  generating  and  transmis- 
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sion  components  has  grown  with  remarkable  consistency,  leading  to  real  econo¬ 
mies  in  total  generation  cost  (Figure  5.1).  The  largest  generating  unit,  at 
first  0.0075  MWe  for  the  earliest  pressure-staging  turbines  [Messing  et  al . 
1979:3],  was  5  MWe  by  1903,  200  MWe  by  1930,  and  then,  after  a  plateau  of  more 
than  25  years,  rose  rapidly  to  about  1300  MWe  by  the  late  1970s — though  it  is 
far  from  clear,  as  we  shall  note  below,  that  the  increase  from  200  MWe  was 
economically  worthwhile.  Maximum  steam  pressures  rose  from  2000  psi  in  the 
1940s  to  over  5000  psi  by  the  1960s,  then  fell  back  to  about  2400  psi  as  it  be¬ 
came  "clear  that  some  of  these  technological  trends  had  been  extrapolated  pre¬ 
maturely"  [_id .  ]  .  Another  kind  of  increased  scale  was  the  trend  towards  multiple 
units  at  one  site:  "while  the  average  size  of  generating  units  increased  from 
22  MWe  in  1938  to  30  MWe  in  1947  and  49  MWe  in  1957  ,  multiple  si  ting... led  to 
increases  in  average  powerplant  sizes  from  26  MWe  in  1938  to  35  MWe  in  1947  and 
96  MWe  in  1957"  [jLd.  :  1 7 ]  .  Maximum  transmission  voltages  also  rose  more  or  less 
exponent i al ly  during  the  hundred-year  history  of  central  electrification,  from 
a  few  kV  to  230  kV  during  the  1930s,  345  kV  by  the  late  1950s,  500  kV  in  the 
early  1960s,  and  765  kV  in  the  late  1960s  (although  megavol t-range  lines  are 
encountering  such  difficulties  that  765  kV  may  represent  a  saturation  level). 
The  increased  voltage  offered,  at  least  at  first,  considerable  economies,  since 
electricity  "can  be  transmitted  over  a  765-kV  line  for  300  miles  as  effectively 
as  over  a  138-kV  line  for  10  miles"  [Congressional  Research  Service  1979:12], 
This  trend  significantly  promoted  concentration  of  utility  ownership. 

Were  these  increases  of  scale  economically  justified?  We  next  enumerate 
the  effects  that  were  considered,  and  those  that  were  not  but  should  have  been. 

5.2.  Diseconomies  of  large  scale. 

5.2.1.  Direct  construction  costs. 

Claimed  economies  of  scale  in  direct  construction  costs  are  dominated  by 
the  relationship  between  variable  and  fixed  costs  and  by  geometrical  relation¬ 
ships,  e.g.  that  the  cost  of  building  a  vessel  depends  mainly  on  its  surface 
area,  while  its  capacity  depends  mainly  on  its  volume,  which  rises  more  steeply 
with  size.  For  this  reason,  a  classical  rule  of  thumb  holds  that  for  chemical 
plants,  power  stations,  etc.,  cost  per  unit  of  capacity  tends  to  rise  only  as 
approximately  the  0.6  power  of  plant  size  [Comtois  1977],  so  that  doubled  capa¬ 
city  increases  total  cost  by  only  52J.  But  in  practice  the  savings  are  mostly 
exhausted  by  the  time  a  power  plant  is  as  big  as  100  MWe,  and  are  trivial  or 
negative  above  a  few  hundred  MWe  (Huethner  1973;  Messing  etal. 1979:204-206] . 


PRICE  OF  ELECTRICITY  (tf/kWh)  (IHS  t) 
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162 


Several  reasons  for  this  departure  from  the  industry's  expectations  can  be 
readily  identified.  First,  a  quarter  or  more  of  the  total  construction  cost  of 
large  projects  is  the  interest  paid  on  construction  capital  before  commission¬ 
ing,  and  "economy  of  scale  is  nonexistent  in  interest  rates"  [Comtois  1977:52]: 
bankers  charge  the  same  interest  rate  on  a  large  loan  as  a  smaller  one,  so  as 
interest  becomes  a  larger  component  of  total  construction  cost,  the  scaling 
exponent  of  total  cost  should  rise  toward  0.7-0. 8  or  more.  Longer  construction 
times,  considered  separately  below,  intensify  this  effect  both  by  increasing 
interest  payments  and  by  decreasing  expected  economies  of  scale. 

Second,  large  plants  may  "involve  more  complexity,  greater  precision, 
smaller  margins  of  error,  and  new  engineering  problems"  compared  to  smaller 
plants  [Messing  et  al .  1979:206].  Thus  the  shift  from  subcritical  to  supercri¬ 
tical  steam  conditions  made  the  engineering  requirements  on  coal  plants  far 
more  stringent.  Larger  nuclear  plants  lost  convective  cooling  capacity  and 
developed  new  potential  accident  modes  not  characteristic  of  small  plants, 
requiring  new  safety  analyses  and  devices.  Larger  facilities  also  tend  to  need 
more  on-site  fabrication,  which  is  costlier  and  more  prone  to  error  than 
prefabrication  of  subsystems  that  can  be  transported  whole  to  the  site.  And 
large  plants  may  require  "custom  design  and  custom  construction.  In  these 
cases,"  remarks  the  former  Chairman  of  Con  Ed  [Messing  et  al.  1979:206],  "a 
consequent  increase  in  the  80  percent  of  the  plant  costs  represented  by  field 
labor  and  overhead — most  of  which  are  time  dependent — make[s]  the  total  cost  of 
a  larger  plant  comparable  to  an  equivalent  number  of  smaller  facilities,"  i.e. 
eliminates  net  economies  of  scale. 

Third,  large  units  must  be  more  or  less  custom-built,  and  cannot  benefit 
significantly  from  economies  of  mass  production.  In  contrast,  with  smaller 
units  "it  becomes  possible  to  standardize  a  design  and  replicate  a  large  number 
of  identical  units."  According  to  a  senior  official  of  the  [U.S.]  General 
Electric  Company,  "this  opens  up  the  possibility  of  a  new  dimension  in  scale 
economy"  which  "may  be  of  considerable  significance"  [Fisher  1979:10].  The 
saving  from  mass  production  can  so  outweigh  traditional  scale  economies  in 
construction  that  the  optimal  turbogenerator  size  would  be  the  smal lest ,  not 
the  largest,  that  can  be  made  for  specified  steam  conditions,  opening  up  "an 
entirely  new  and  profoundly  different  avenue  for  reducing  the  capital  cost  of 
generating  capacity."  [_id_.  :  1 2 ]  Thanks  to  mass  production,  car  engines  cost 
only  a  few  dollars  per  kW  of  shaftpower,  while  the  engines  that  drive  power 
stations  cost  hundreds  of  dollars  per  kW.  Car  engines  could  be  made  as  durable 
as  power-station  prime  movers  at  an  extra  cost  very  much  smaller  than  their  ini¬ 
tial  cost  difference,  leaving  at  least  a  tenfold  saving  from  mass  production. 


163 


The  combined  result  of  these  phenomena  (except  perhaps  for  mass  produc¬ 
tion,  which  is  seldom  relevant  at  the  large  unit  sizes  considered)  is  illustra¬ 
ted  by  an  exhaustive  statistical  analysis  of  the  entire  body  of  U.S.  experience 
with  commercial  coal  and  nuclear  power  stations  [Komanoff  1981].  For  nuclear 
plants,  the  scale  exponent  is  not  0.6  as  hoped  but  rather  0.904 — that  is,  doub¬ 
ling  the  plant  size  reduces  the  direct  construction  cost  per  installed  kWe  by 
only  13%,  not  by  the  20-30%  assumed  in  all  industry  and  government  cost  analy¬ 
ses.  (The  very  existence  of  the  decline  is  also  statistically  less  certain 
than  for  most  cost  variables.)  As  will  be  mentioned  below,  construction  time 
also  increases  with  unit  size,  and  the  extra  interest  costs  decrease  the  13% 
saving  per  kW  with  doubled  capacity  to  only  10% — two  or  three  times  less  than 
is  normally  assumed  [id.: 200 ] .  For  coal  plants,  although  it  is  normally  pre¬ 
sumed  that  doubled  size  reduces  cost  per  kWe  by  10-15%,  there  is  in  fact  no 
statistically  significant  correlation  between  size  and  cost:  at  most,  there 
might  be  (at  only  82%  statistical  significance)  a  gross  cost  saving  of  3%, 
reduced  to  only  2%  net  by  the  longer  construction  time  [  id  . : 2 20 ]  . 

5.2.2.  Operating  costs. 

Although  no  detailed  data  are  yet  available  on  operating  and  maintenance 
costs  as  a  function  of  unit  size,  it  is  clear  from  operating  experience  with 
all  kinds  of  power  stations  that  larger  ones  tend  to  have  more  numerous  and 
complex  failure  modes,  longer  downtime,  more  difficult  repairs,  higher  training 
and  equipment  costs  for  maintenance,  higher  carrying  charges  on  spare-parts 
inventories,  and  higher  unit  costs  of  spare  parts  made  in  smaller  production 
runs.  Fisher  [1979:10]  notes  more  simply  that  there  "may  be  a  reduction  in 
maintenance  personnel  for  smaller  units  because  of  their  higher  reliability" 
(discussed  further  below).  Large  units  may  be  more  able  to  afford  and  equip 
the  specialized  maintenance  cadres  they  require,  but  become  correspondingly 
more  vulnerable  to  those  cadres'  whims,  as  noted  in  Chapter  2.1.11. 

The  repair  problems  of  large  industrial  plants  generally  have  been 
surveyed  by  Petzinger  [1981].  High  interest  rates  have  "made  it  more  important 
than  ever  to  keep  plants  operating,"  and  the  "high  cost  of  financing  inventor¬ 
ies  has  forced  manufacturers  to  live  within  tight  production  schedules:  any 
equipment  breakdown  is  bound  to  anger  customers  and  likely  to  cost  a  company 
business.  Yet  while  costly  money  has  increased  the  pressure  to  avoid  break¬ 
downs,  it  has  also  made  them  more  likely.  Many  companies  believe  they  are 
forced  to  cut  corners  when  building  new  plants,  either  by  eliminating  backup 
equipment  or  going  without  spare  capacity.  'it  used  to  be  that  you'd  install  a 
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spare  pump  at  every  critical  point  in  a  refinery.  You  can't  afford  to  do  that 
willy-nilly  now,'  says  [a  senior  officer  of  a  construction  f i rm]  ...  .Moreover , 
neither  equipment  manufacturers  nor  their  customers  can  afford  to  keep  a  wide 
range  of  space  parts  in  stock.  This  is  due  not  only  to  the  high  cost  of  finan¬ 
cing  the  parts,  but  also  to  the  cost  of  the  parts  themselves.  Westinghouse 
Electric  Corp.  has  managed  to  sell  about  100  spare  power-plant  turbine-rotors 
in  the  past  five  years  by  persuading  utilities  that  they  can  save  seven  days  of 
costly  outage  by  having  parts  on  hand.  But  for  many  utilities  the  cost  of 
these  spares,  currently  $1  million  to  $7  million,  is  prohibitive."  Simply 
installing  them  is  a  risky  and  demanding  operation:  "We're  dealing  with  things 
that  are  extremely  heavy  and  yet  extremely  delicate,"  said  a  Con  Ed  official. 

Since  smaller  plants  are  normally  simpler,  lower  skills  and  standards  of 
maintenance  may  suffice;  the  plants  are  more  comprehensible  to  their  staff;  and 
they  are  more  likely,  in  a  technical  sense,  to  fail  slowly  and  gracefully.  All 
the  extra  costs  of  maintenance  for  larger  plants  then  operate  in  reverse.  It 
may  be  true  that  it  is  simpler  to  arrange  delivery  of  fuel,  or  conversion  from 
one  fuel  to  another,  for  a  single  large  plant  than  for  multiple  smaller  plants; 
but  this  argument  is  irrelevent  to  comparisons  between  conventional  power  sta- 
t ions  and  renewable  energy  sources,  which  depend  on  a  energy  flux  that  is 
freely  distributed  and  [stochastically]  assured. 

5.2.3.  Availability 

A  low  cost  per  kW  of  installed  capacity  is  useless  if  that  capacity  is  not 
available  to  provide  energy.  The  reliability  of  large  power  stations  has  in 
fact  been  generally  discouraging.  As  Robert  Mauro  of  the  American  Public 
Power  Association  remarked  (Messing  et  al .  1979:209),  "the  disappointing  avail¬ 
ability  record  of  many  large  units  has  diminished,  if  not  entirely  dissipated 
[,]  the  theoretical  savings  expected  from  bigness ....[ It  is  ironic  thatl  many 
smal l .. .electric  utilities,  which  have  been  jeered  at  for  operating  'obsolete' 
plants  with  ' tea-kettle3, '  have  had  fewer  problems  in  maintaining  adequate 
power  supply  than  some  larger  systems  with  modern  large-scale  units."  Romanoff 
{1981)  has  quantified  these  effects.  The  capacity  factor  (actual  output  as  a 
fraction  of  full-time  full-power  output)  of  all  commercial  U.S.  power  reactors 
through  June  1980  averaged  66%  for  the  23  plants  (173  plant-years)  under  800 
MWe ,  but  only  54%  for  the  39  plants  (188  plant-years)  over  800  MWe .  Sufficient 
experience  is  available,  according  to  the  industry,  to  distinguish  statistical¬ 
ly  the  effects  of  age  from  those  of  size.  The  correlation  of  the  12-percentage- 
point  gap  with  size  is  now  unmistakalle  [id.  :248]  .  The  inverse  correlation  of 


availability  with  size  is  equally  striking  for  coal  plants  [_ici. : 253-257]  :  dur¬ 
ing  1961-73,  average  unit  size  increased  from  226  to  400  MWe  while  capacity 
performance  (a  measure  of  availability)  fell  from  79.62  to  69.32.  Coal  plants 
in  the  size  range  400-800  MWe  were  about  8  percentage  points  less  available 
than  200-400-MWe  ones.  For  all  coal  and  oil  plants,  1967-76,  the  forced  outage 
rate  (fraction  of  the  time  the  plant  was  broken  down)  ranged  [Ford  &  Flaim 
1979:35]  from  2.52  for  plants  <100  MWe  to  16.12  for  >799  MWe,  rising  more  and 
more  steeply  with  increasing  size  in  between  [Anson  1977].  It  is  partly  for 
this  reason  that  the  average  size  of  newly  installed  coal  plants  fell  from 
about  700  MWe  in  1971  to  440  MWe  in  1978;  300  MWe  is  now  a  common  size. 

Similar  experience  abounds  worldwide.  As  the  Federal  Energy  Administra¬ 
tion  was  castigating  the  dismal  reliability  of  large  new  power  plants  in  the 
U.S.  [Weekly  Energy  Report  1975],  similar  evidence  was  already  accepted  in 
Europe  as  indicating  a  fundamental  mistake  had  been  made  in  investment 
strategy.  A  German/ British  conference  in  1973,  for  example,  had  already  found 
that  poor  availablity  had  cancelled  expected  economies  of  scale  in  coal  plants. 
The  larger  plants  took  longer  to  "mature1* — to  overcome  their  "teething  troub¬ 
les" — and  never  did  become  as  reliable  as  smaller  units:  after  four  years' 
operation,  availabilities  ranged  from  atrnt  822  for  60-MWe  units  (which  had 
levelled  off  at  their  "mature"  availability)  to  only  about  522  for  500-MWe 
units,  which  were  still  far  from  maturity.  Intermediate  sizes  fitted  into  this 
correlation  correspondingly. 

The  reasons  for  the  correlation  are  simple  and  fundamental.  A  500-MWe 
boiler  has  approximately  ten  times  as  many  miles  of  tubing  as  a  50-MWe  boiler, 
so  "a  tenfold  improvement  in  quality  control  is  necessary  to  maintain  an  equi¬ 
valent  standard  of  availability  for  the  larger  unit"  [Electrical  Times  1973]  . 

A  more  complex  control  system  encounters  the  discouraging  mathematics  of  multi¬ 
plicative  component-failure  probabilities  (pages  150-151).  A  large  turbine  has 
correspondingly  high  blade-root  stress*,  often  forcing  the  designer  to  use  exo¬ 
tic  alloys  with  unexpected  characteristics:  highly  skilled  turbine  designers  in 
several  advanced  industrial  nations  have  watched  their  turbines  explode  because 
the  metal  did  not  behave  as  hoped.  The  technological  evolution  required  to 
meet  ever  more  stringent  performance  standards  exhibits  diminishing  returns  to 
money  and  talent  invested:  any  technology  which  tries  to  sustain  a  short 
doubling  time  indefinitely  will  come  unstuck  sooner  or  later.  Scaling  up 
rapidly  often  outruns  engineering  experience  (especially  in  long- lead-t ime 
technologies).  Detailed  assessments  of  reactor  r'Mnponent  reliability — pumps, 
valves,  etc. — show  lower  reliability  at  larger  scale  [Procaccia  1975;  see  also 
Knox  1977].  Since  about  802  of  the  cost  of  sending  out  a  unit  of  electricity 


♦The  same  effect  (plus  vibration)  makes  megawatt-range  wind  machines  complex 
and  costly.  No  net  economies  of  scale  have  been  demonstrated  above  20-50  kWp. 
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from  a  nuclear  plant  is  its  capital  cost  (or  about  half  that  much  for  coal 
plants),  electricity  price,  even  after  the  cost  of  delivery  is  added,  is 
strongly  sensitive  to  reliability. 

5.2.4.  Thermal  efficiency. 

Power-plant  engineers  have  devoted  immense  ingenuity  to  trying  to  increase 
the  amount  of  electricity  derived  from  each  unit  of  fuel.  By  the  1960s,  aver¬ 
age  thermal  efficiencies  had  been  improved  from  <23%  to  about  34%.  But  in 
recent  years,  average  plant  efficiency  has  slightly  decreased .  This  is  partly 
because  larger  plants,  built  in  the  hope  of  wringing  another  few  tenths  of  a 
percentage  point  out  of  the  thermal  inefficiency,  proved  less  reliable  [Elec¬ 
trical  World  1975].  Their  frequent  stopping  and  starting  greatly  increased 
heat  losses  and  entailed  more  part-loaded  operation  at  reduced  efficiency.  Thus 
in  Britain,  for  example,  among  stations  of  the  same  size  (500  MWe) ,  thermal 
efficiency  ranged  from  23-24%  for  plants  with  5-10%  capacity  factor  to  34-35% 
for  plants  with  >60%  capacity  factor  [Electrical  Times  1973].  For  all  plants 
>449  MWe,  the  correlation  was  equally  strong  [Abdulkarim  &  Lucas  1977:226];  the 
adoption  of  a  standard  size  of  500  MWe  instead  of  the  optimal  size  of  200-300 
MWe  (based  only  on  availability,  thermal  efficiency,  maintenance  cost,  lead 
time,  and  direct  capital  cost  as  functions  of  size)  led  to  a  16%  overbuilding 
of  U.K.  generating  capacity.  In  the  U.S.,  the  ten  most  efficient  power  plants 
operated  in  1974  (with  heat  rates  around  8800-9200  BTU/kWe-h  or  thermal  effi¬ 
ciencies  around  37-39%)  ranged  in  size  from  238  to  950  MWe  and  in  vintage  from 
1958  to  1970;  the  larger  or  newer  units  were  on  the  whole  no  more  efficient 
than  the  older  and  smaller  ones  [Messing  et  al .  1979:10,14]*. 

5.2.5.  System  integration. 

The  thermal  efficiency  of  a  power  plant  is  inadequately  measured  by  its 

conversion  of  fuel  only  into  electricity,  because  this  process  inevitably  loses 

about  two-thirds  of  the  fuel's  energy  in  the  form  of  low-temperature  heat  which 

is  normally  wasted.  By  capturing  this  heat  and  using  it  to  heat  buildings  or 

greenhouses  via  a  combined— heat-and— power  station  and  district  heating,  the 

thermal  efficiency  of  converting  the  fuel  into  useful  work  can  be  raised  to  80% 

or  more.  This  can  also  be  done  on  the  scale  of  a  neighborhood  or  building  with 

great  economic  savings  [Hein  1979].  Alternatively,  if  electricity  is  made  in  a 

factory  as  a  byproduct  of  high-temperature  heat  or  steam  already  being  made 

there,  this  "cogenerated"  electricity  [Williams  1978]  can  cost  about  half  as 

*Efficiency  (and  energy  cost)  are  likewise  uncorrelated  with  unit  scale  or 
centralization  in  most  solar-thermal  technologies  [OTA  1978  ;  Caputo  1977]. 
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much,  and  use  about  half  as  much  fuel,  as  would  result  from  making  the  same 
amounts  of  electricity  and  process  heat  in  separate  installations.  It  is  not 
hard  to  estimate,  as  a  general  illustration,  that  if  an  electrical  generating 
system  is  losing  two-thirds  of  its  fuel  input  as  waste  heat,  as  is  approximate¬ 
ly  the  case  nationally,  and  if  (conservatively)  two-thirds  of  that  otherwise 
wasted  energy  can  be  recaptured,  then  if  the  heat  displaces  that  from  a  70%- 
efficient  furnace  fired  with  $36/bbl  OPEC  oil,  each  kW-h  of  electricity  will 
receive  a  waste-heat  credit  worth  4.3i — more  than  the  entire  cost  of  generating 
an  average  kW-h  in  the  U.S.  today.  The  cost  of  the  apparatus  to  capture  and 
use  the  heat  will  be  a  small  fraction  of  this  value. 

Ability  to  take  advantage  of  such  opportunities  for  integration  depends  on 
unit  scale.  A  1-GWe  power  station  produces  about  2  GWt  of  warm  water — far  too 
much  to  use  conveniently.  The  largest  readily  manageable  conb ined-heat-and- 
power  systems  operating  in  Sweden  (a  leader  in  this  technology)  are  half  this 
size,  serving  the  heat  and  power  needs  of  a  city  of  about  100,000,  but  the 
district  heating  system  took  17  years  to  build  up.  Sizes  of  tens  of  MWe  down 
to  tens  of  kWe  or  less  (for  apartment  buildings)  are  far  more  tractable. 

Similar  integration  opportunities  exist  for  sharing  infrastructure,  cost, 
inputs,  and  outputs  between  energy  systems  and  buildings,  food  and  water 
systems,  etc.  Such  opportunities  are  greatest  with  renewable  energy  sources, 
as  Chapter  7  will  illustrate  further. 

5.2.6.  Transmission  and  distribution  costs. 

Large-scale  energy  sources  are  mismatched  to  the  scale  of  most  energy  uses. 
For  U.S.  private  electric  utilities  in  1965-71,  for  example,  the  average  power 
density  of  final  demand  was  of  the  order  of  0.030  W/m2,  ranging  an  order  of 
magnitude  higher  or  lower  in  extreme  cases.  The  density  for  nonindustrial  users 
was  only  half  this  great  (p.  27)--an  exceedingly  low  density,  about  1/12,000 
that  of  sunlight.  A  1-GWe  plant  with  a  load  density  of  0.030  W/m2  will 
serve  a  territory  with  a  radius  of  about  150  km.  (The  average  distance  electri¬ 
city  is  transmitted  from  new  plants  of  all  sizes,  including  many  around  1  GWe, 
is  actually  about  350  km  in  the  U.S.  — 100  km  in  the  denser  European  grid — partly 
to  benefit  from  load  diversity,  the  fact  that  different  uses  occur  at  different 
times,  so  a  given  amount  of  capacity  can  be  shared  among  more  demands  than  it 
could  meet  simultaneously.  This  is  an  economy  of  scale  of  the  grid,  not  of  its 
power  stations.)  Thus  large  power  stations  provide  enormous  amounts  of  energy 
from  a  small  site,  but  energy  uses  tend  to  be  dispersed  over  a  very  large  area. 

This  mismatch  between  supply  density  and  load  density  entails  a  costly 
transmission  and  distribution  network.  In  1972,  the  last  year  for  which  a  de¬ 
tailed  analysis  is  available,  the  cost  of  building  and  maintaining  that  grid 


168 


accounted  for  about  70%  of  the  cost  of  delivered  U.S.  electricity  [Baughman  & 
Bottaro  1976] — more  than  twice  the  cost  of  generation.  (Similarly,  transmis¬ 
sion  and  distribution  accounted  for  65%  of  delivered  residential  gas  prices  in 
1976,  and  wellhead  gas  for  only  29%  [AGA  1977].)  In  recent  years,  these  ratios 
have  probably  shifted:  U.S.  electric  utilities  spent  about  73%  of  their  1979 
investment  on  generation,  10%  for  transmission,  and  13%  for  distribution,  com¬ 
pared  with  50%,  19%,  and  28%  respectively  in  1969  [Economic  Regulatory  Adminis¬ 
tration  1980:Exec .Summ. :9] .  But  since  the  grid  also  loses  about  a  tenth  of  the 
electricity  sent  through  it,  and  since  the  cost  of  operating  and  maintaining 
the  grid  is  probably  greater  than  the  capital  charge  for  transmission  [Baughman 
&  Bottaro  1976],  even  this  marginal  cost  breakdown  suggests  that  about  a  third 
of  the  price  of  marginal  delivered  electricity  is  for  delivering  it,  not  for 
generating  it.  This  is  a  significant  diseconomy  in  the  large  scale  of  genera¬ 
tors.  Both  costs  and  losses  could  be  greatly  reduced  by  better  matching  of 
scale  to  end  uses — the  same  strategy  that  can  reduce  vulnerability. 

Some  estimates  of  the  "dispersion  credit"  that  smaller  generating  units 
can  provide  by  saving  transmission  and  distribution  investment  have  been 
published.  A  recent  survey  of  five  such  studies  using  widely  varying  assump¬ 
tions  [Systems  Control  1980 : Summ. :43-44]  found  credits  ranging  from  $8  to  $165 
per  kW  of  dispersed  generating  capacity.  None  of  these  studies  allowed  credit 
for  displacing  underground  cables,  which  constitute  the  majority  of  new  primary 
distribution  circuits  and  can  cost  10-40  times  as  much  as  overhead  circuits. 
Several  of  the  studies  did,  however,  include  credit  for  increased  reliability 
of  service  to  the  end-users.  This  arises  because  a  source  at  the  distribution 
substation,  or  even  closer  to  end-users,  protects  them  from  transmission 
failures — the  dominant  cause  of  all  supply  failures — and  may  thus  improve 
reliability  by  a  factor  of  ten  or  even  twenty.  (To  procure  the  greatest 
benefit,  the  dispersed  source  should  be  as  close  to  the  user  as  possible,  since 
an  estimated  85-95%  of  all  customer  outages  are  due  to  failures  in  distribu¬ 
tion,  not  in  the  bulk  generation/transmission  system  [ id  . : Rpt . : 5  .47 ;  Systems 
Control  1980:3-7;  cf_.  Economic  Regulatory  Administration  1981:4-10].) 

5.2,7.  Reserve  margin. 

The  unreliability  of  large  units  is  worse  than  appears  at  first  sight, 
because  the  possibility  that  a  large  unit  might  fait  requires  the  provision  of 
an  equally  large  block  of  backup  capacity  to  protect  the  grid.  Conversely,  a 
larger  number  of  smaller  units  provides  partial  protection  because  they  are  not 
all  likely  to  fail  at  the  same  time  [Ouwens  1977]  and  hence  would  need  less 
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reserve  margin  to  achieve  the  same  reliability.  "The  enhanced  reliability 
contribution  of  small  generating  units  arises  because  the  failure  of  a  single 
large  unit  is  more  likely  than  the  simultaneous  failure  of  two  smaller  units 
equalling  the  same  capacity."  [Economic  Regulatory  Administration  1981:7-4f] 

For  this  reason,  several  studies  of  typical  interconnected  grids  [e.g.  Kahn 
1977;  Wisconsin  PSC  1977]  show  that  building  several  power  plants  of  300-400 
MWe,  rather  than  a  single  1000-MWe  plant,  would  provide  the  same  level  and 
reliability  of  service  with  about  a  third  less  new  capacity.  Thus  1  GWe  of 
nuclear  capacity  at  the  margin  should,  in  such  a  grid,  be  compared  in  costs  and 
impacts  with  perhaps  0.7  GWe  of  coal  plants  because  the  latter  can  come  in 
smaller  units.  For  still  smaller  units,  such  as  10-MWe  fuel  cells  sited  at 

distribution  substations,  the  savings  in  extra  capacity  to  do  the  same  task  may 

exceed  60 %  [Peschon  1976]  because  of  the  added  protection  from  grid  failures. 
(This  saving  diminishes  as  more  dispersed  sources  are  added  to  a  standard  grid.) 

Another  illustration  of  the  saving  in  reserve  capacity  is  offered  by  a 
calculation  by  Peschon  etal.  [personal  communication,  1978],  For  a  loss-of- 
load  probability  of  one  day  in  ten  years  (the  normal  U.S.  standard)  and  a  forced 
outage  rate  of  4 %,  generating  units  with  a  size  sufficient  to  supply  2%  of  the 

peak  load  require  reserves  of  only  5%  of  the  peak  load;  units  providing  10%  of 

peak  load  require  about  an  11%  reserve;  units  providing  20%  need  about  23%; 
units  providing  50%  need  about  65%.  That  is,  the  reserve  requirements  rise 
steeply  with  bigger,  "lumpier"  units.  For  a  15%  forced  outage  rate,  the  reserve 
requirements  at  these  unit  sizes  are  respectively  about  22%,  43%,  62%,  and  150%: 
that  is,  the  reserve  requirements  are  greatly  accentuated  by  the  unreliability 
of  the  units.  The  reserve  requirements  rise  even  more  steeply  in  grids  that  are 
not  interconnected  [Galloway  &  Kirchmayer  1958]. 

A  detailed  analysis  by  Ford  &  Flaim  [1979]  used  empirical  cost  and  perfor¬ 
mance  data  to  compare  two  patterns  of  building  coal-fired  power  plants:  four  of 
750  MWe  or  nine  of  250  MWe.  The  larger  plants  would  need  require  a  third  great¬ 
er  total  capacity  to  do  the  same  job  because  they  are  less  reliable  and  can 
"drop  out"  more  capacity  at  once.  The  smaller  plants'  25%  capacity  savings,  19% 
(11  percentage  points)  higher  capacity  factor,  ca.  44%  shorter  construction  time 
(5  years  instead  of  9),  and  59%  (8.1  percentage  points)  lower  forced  outage  rate 
make  up  for  their  15%  worse  thermal  efficiency,  11%  higher  capital  cost/kW,  and 
slightly  higher  costs  for  coal  transportation  and  electricity  transmission.  When 
all  these  effects  are  balanced,  the  total  cost  (discounted  to  present  value)  of 
building  the  smaller  plants  is  less  by  1%  in  operation,  17%  in  construction,  and 
6.1%  in  lifetime  electricity  price--a  total  saving  of  $227  million  (1977  $) 
compared  to  the  larger  plants  [id.;  Ford  1979).  Many  other  potential  cost 
savings,  such  as  district-heating  potential  or  reduced  cost  of  money  from  the 
more  favorable  construction  cash  flow,  were  not  included  in  this  analysis. 


5.2.8.  Construction  time  and  indirect  costs. 

As  cost  of  money  and  escalation  of  real  capital  cost  take  a  larger  share 
of  total  construction  costs,  due  to  the  interrelated  increase  of  capital 

intensity,  scale,  technical  complexity,  perceived  impacts  [Romanoff  1981],  and 
lead  times,  total  economies  of  scale  decline  [Comtois  1977]  .  There  is  some 
evidence  that  for  very  large  units,  economies  of  scale  in  capital  cost  per 
installed  kWe  actually  become  negative .  Figure  5.2,  for  example,  shows  the 
capital  cost  per  installed  kWe  (squares)  or  per  kWe  available  to  be  sent  out 
(triangles)  as  a  function  of  unit  size.  The  sample  is  half  of  the  thermal  power 
stations  commissioned  in  the  U.S.  in  a  two-year  period  during  1972-74  [Electri¬ 
cal  World  1975;  Lovins  1977:92]*.  Remarkably,  capital  cost  per  installed  kWe  in 
this  sample  is  less  for  a  small  station  than  for  a  very  large  one. 


Figure  5.2:  Average  unavailability  and  specific  capital  cost  vs.  unit  size  in  a 


net  stetion  capacity,  MW(e| 


*The  sample  includes  17-18  coal-fired,  2-4  nuclear,  3  gas-fired,  2  gas-  or 
oil-fired,  and  1-2  oil-fired  stations — a  total  of  29  in  every  region  except  New 
England.  Point  A  is  from  the  original  source's  graph,  point  B  from  its  suppos¬ 
edly  corresponding  tabular  data;  their  difference  apparently  reflects  very  high 
unavai labil i ty  in  the  four  very  large  stations  included  in  the  graph  but  whose 
availability  figures  are  omitted  from  the  table.  The  right-hand  triangular 
point  is  calculated  with  the  lower  value  (B).  Romanoff's  [1981]  smallest  reac¬ 
tor  is  457  MWe,  so  his  positive  economy  of  sra1<»  is  consistent  with  th*>  prsph. 
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A  possible  explanation  for  this  unexpected  result  arises  from  differences 
in  construction  times  as  a  function  of  scale.  Although  it  might  seem  intuitive¬ 
ly  ttet  doubling  the  size  of  a  plant  will  double  its  construction  time,  utilities 
have  traditionally  expected  any  increase  in  construction  time  to  be  negligible. 
Komanoff,  however,  finds  [1981:208-209,224]  that  doubling  the  size  of  a  nuclear 
or  coal  plant  actually  increases  its  construction  time  by  28%  or  13%  respective¬ 
ly,  simply  because  of  the  sheer  volume  of  materials  and  labor  whose  use  must  be 
coordinated.  (These  increases  refer  only  to  actual  construction  time,  not  to 
licensing.  Komanoff  [1981:205],  like  Mooz  [1978,1979],  found  no  statistically 
significant  correlation  between  licensing  duration  and  reactor  cost.)  Ford  & 
Flaim  [1979],  who  also  consider  the  process  of  siting  and  licensing,  find  even 
stronger  scale  effects  on  construction  time.  The  Federal  Power  Commission  re¬ 
ported  that  during  1967-76,  utilities  cited  vendor-related  problems  (late  deliv¬ 
ery,  unacceptable  quality,  etc.)  as  being  responsible  for  37%  of  their  plant 
delays,  poor  site  labor  productivity  and  other  labor-related  problems  for  34%, 
regulatory  problems  for  13%,  utility-related  problems  (chiefly  finance)  for  9%, 
and  bad  weather,  legal  challenges,  and  all  other  causes  for  8%  [Messing  et  al . 
1979:207],  The  complexity  of  large  projects  increases  vulnerability  to  all 
these  problems. 

Longer  construction  times  increase  the  indirect  costs  of  construction  in 
at  least  seven  ways,  some  of  which  are  difficult  to  quantify.  First,  longer 
lead  time  increases  exposure  to  real  cost  escalation  [Komanoff  1981].  Second, 
it  increases  the  absolute  and  fractional  burden  of  interest  during  construction 
[Comtois  1977].  Third,  it  makes  the  utility's  cash  flow  less  favorable,  reduces 
the  self-financing  ratio,  increases  the  debt/equity  ratio,  reduces  the  interest 
coverage  ratios,  and  generally  increases  the  utility's  financial  risk  and  hence 
its  cost  of  money  in  the  capital  marketplace  [Kahn  &  Schutz  1978;  Wiegner  1977]. 
Fourth,  it  increases  the  project's  exposure  to  regulatory  changes  during  con¬ 
struction  [Komanoff  1981]  and  to  technological  progress  that  can  alter  the 
design  criteria  or  even  make  the  project  obsolete.  Fifth,  it  may  increase  the 
incentive  (and  bargaining  power)  of  some  construction  unions  to  demand  very  high 
wages,  or  to  stretch  out  construction  still  further,  or  both  (as  occurred  on  the 
Trans-Alaska  Pipeline).  Sixth,  large  plant  scale  increases  the  transaction 
costs  of  siting  [Ford  &  Flaim  1979]  because  its  impacts  are  more  obtrusive. 

(This  may  lead  utilities  to  try  to  maximize  installed  capacity  per  site,  making 
the  project  so  big  and  problematical  that  the  plant  be'comes  a  worse  neighbor 
than  it  should  have  been,  so  the  next  site  becomes  that  much  more  difficult  to 
find,  and  so  on  exponentially.)  Seventh,  long  lead  time  exposes  the  builders  to 
high  financial  risk  because  of  uncertainty.  This  problem  deserves  explanation. 
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"[T]he  greater  time  lags  required  in  planning  [and  building)  giant  plants 
mean  that  forecasts  [of  demand  for  them]  have  to  be  made  further  ahead,  with 
correspondingly  greater  uncertainty;  therefore  the  level  of  spare  capacity  to  be 
installed  to  achiae  a  specified  level  of  security  of  supply  must  also  increase." 
[Cantley  1979]  Longer  lead  time  increases  both  the  uncertainty  of  demand 
forecasts  and  the  penalty  per  unit  of  uncertainty.  Some  analysts  [Cazalet  ejj_ 
al .  1978;  Stover  et  al .  1978]  have  attempted  to  show  that  the  penalty  for  under¬ 
building  is  greater  than  the  penalty  for  overbuilding;  but  their  recommendations 
— to  overbuild  baseload  plants — are  artifacts  of  flaws  in  their  models  [Ford 
1978;  Ford  &  Yabroff  1978;  Lovins  1981].  More  sophisticated  simulations  [Ford  & 
Yabroff  1978;  Ford  1978,1979a;  Boyd  &  Thompson  1978]  show  on  the  contrary  that 
(at  least  for  utilities  which  do  not  carry  unfinished  plants  in  their  rate  base) 
if  demand  is  uncertain,  the  low-financial-risk  strategy  is  deliberately  to 
underbuild  large,  long-lead-time  plants.  There  are  three  reasons  for  this.  The 
extra  carrying  charges  on  unused  large  plants  exceed  the  extra  operating  costs 
on  overused  short-lead-time  stopgap  plants  (even  gas  turbines);  short-lead-t ime 
plants  have  a  shorter  forecasting  horizon  and  hence  greater  certainty  of  being 
needed;  and  short-lead-time  plants  can  be  built  modularly  in  smaller  blocks, 
responding  more  closely  to  short-term  perceptions  of  need.  These  qualities  all 
reduce  the  financial  risk  and  therefore  the  utility's  cost  of  money  [Kahn 
1978:333f;  Lovins  1981;  Appendix  A]  . 

5.2.9.  Control  of  residuals. 

It  is  often  claimed  that  centralization  simplifies  control  of  residuals, 
such  as  air  pollutants  released  by  burning  coal.  But  there  are  many  counter¬ 
arguments.  Smaller  scale  may  reduce  the  total  load  of  residuals  by  permitting 
the  use  of  combined-heat-and-power  plants  or  of  more  flexible  and  inherently 
benign  processes  (for  example,  fluidized-bed  combustion  of  coal,  now  commercial¬ 
ly  available  in  sizes  of  tens  or  even  hundreds  of  MWt  but  not  of  GWt).  Smaller 
scale  lowers  both  the  risk  and  the  cost  of  failure  in  individual  pollution-con¬ 
trol  installations:  less  will  get  out  than  in  the  case  of  failure  at  a  large 
plant,  and  there  is  less  fiscal  incentive  to  bypass  a  defective  scrubber  than  if 
the  alternative  were  shutting  down  a  major  power  station).  Smaller  scale,  by 
siting  the  plant  near  its  users,  also  gives  them  a  direct  incentive  to  insist 
that  it  run  cleanly  and  quietly.  For  example  [Hein  1979],  a  combined-heat-and- 
power  plant  powering  and  heating  an  apartment  complex  at  Heidenheim,  West 
Germany,  uses  a  natural-gas-fired  Otto  engine  built  in  a  garage-like  structure. 
Its  acoustic  isolation  is  so  effective  that  its  noise  cannot  be  distinguished 
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from  the  noise  of  water  running  underground  in  the  sewers  at  midnight.  It  has 
to  be  that  quiet — because  there  is  a  house  a  few  meters  from  the  exhaust.  Since 
the  people  who  get  the  energy  also  get  the  side-effects  themselves,  they  insist 
that  the  project  be  built  right.  (The  extra  cost  of  the  soundproofing  is  very 
quickly  recovered  from  the  economic  savings  from  using  the  waste  heat.)  Conver¬ 
sely,  when  a  large  plant  is  rurally  sited,  agrarian  politicians  are  often 
impotent  to  enforce  environmental  standards  in  the  face  of  its  overwhelming 
economic  power.  The  result  is  often  inequity,  giving  rise  to  tensions  and 
perhaps  to  violence  [Gerlach  1979;  —  &  Radcliffe  1979;  Casper  £»  Wellstone  1981]. 

5.2.10.  Other  issues  of  scale  economics. 

Large  plants  may  make  it  easier  to  use  and  finance  the  best  technologies 
currently  available.  On  the  other  hand,  smaller  plants  with  shorter  lead  times 
may,  at  each  stage  during  rapid  technological  evolution,  have  less  capital  sunk 
in  inflexible  infrastructure,  and  may  reflect  a  shorter  institutional  time-con¬ 
stant  for  getting  and  acting  on  new  information.  Small  plants  may  be  perceived 
as  so  benign,  and  fit  so  well  onto  existing  sites  near  users  (such  as  the  sites 
of  old  municipal  power  stations),  that  they  have  few  siting  problems:  they  offer 
far  greater  siting  flexibility  [Fisher  1979:10]  than  large  plants,  and  this  in 
turn  saves  transmission  costs  and  losses,  increases  the  scope  for  total-energy 
systems,  and  encourages  the  use  of  inherently  superior  sites.* 

A  social  or  psychological  perspective  suggests  many  further  scale  effects. 
Some,  like  users'  perceptions  of  dependency  or  oligopoly,  are  beyond  our  scope 
here  [Lovins  1977b].  Others  are  of  a  more  technical  character.  For  example, 
large  technologies  tend  to  submerge,  but  small  ones  to  emphasize,  individual 
responsibility  and  initiative.  This  may  improve  the  quality  of  work  and  deci¬ 
sions.  Furthermore,  large  technologies,  as  Freeman  Dyson  has  remarked,  are 
"less  fun  to  do  and  too  big  to  play  with."  They  are  so  complex  and  expensive 
that  their  design  is  fixed  by  commi t "ees ,  not  changeable  by  a  single  technolo¬ 
gist  with  a  better  idea.  The  kind  of  fundamental  innovation  which  evolved 
cheaper  and  more  effective  energy  systems  in  the  past  has  often  depended  on  the 
technologies'  accessibility  to  a  multitude  of  tinkerers.  (This  emerges  clearly 
from  the  relative  speed  of  innovation  in  large  vs.  small  wind  machines  or  in 
mainframe  vs.  microcomputers.)  The  ability  of  a  single  person  to  understand  a 
technology  and  make  a  basic  contribution  to  it  is  of  fundamental  importance: 
there  is,  so  far  as  we  know,  nothing  in  the  universe  so  powerful  as  four  billion 
minds  wrapping  around  a  problem.  It  is  for  this  reason  that  many  of  the  most 


*Some  instances  of  siting  problems  with  small  units  have  been  reported,  how¬ 
ever,  especially  if  the  local  community  has  not  participated  in  the  decision. 
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exciting  solar  developments,  as  noted  earlier,  are  the  work  of  individuals, 
often  without  the  trappings  and  inertias  of  '\>  i g  science." 

Finally,  small  units,  especially  with  local  storage  or  optional  intercon¬ 
nections,  can  not  only  increase  the  resilience  of  energy  supply  in  the  many  ways 
described  in  previous  and  subsequent  chapters;  they  can  also  be  far  more  easily 
protected,  repaired,  and  replaced  or  augmented  by  expedient  means.  Replacement 
or  augmentation  will  be  discussed  further  in  Chapter  6,  and  repair  in  subsequent 
Chapters.  Protection,  in  a  civil-defense  sense,  can  be  as  simple  as  placing  a 
device  "on  shock-absorbing  material  such  as  styrofoam  blocks,  wrapping  it  in 
plastic,  covering  it  with  crushable  material  such  as  plastic  chips  or  metal  sha¬ 
vings,  and  covering  this  all  with  a  thick  layer  of  dirt."  (Joint  Committee  on 
Defense  Production  1977:11:45]  Such  measures,  adapted  from  Soviet  practice  by 
Boeing  for  protecting  industrial  equipment,  can  protect  it  from  "extremely  high 
blast  pressures,  and  presumab ly. from]  fires  and  falling  debris."  No  similar 
techniques  are  applicable  to  large-scale  technologies,  which  are  conspicuous, 
tempting  targets,  hard  to  repair,  hard  to  replace,  and  impossible  to  shield. 

To  summarize  the  economic  arguments  so  far:  the  economies  of  scale  classi¬ 
cally  expected  in  direct  construction  costs  are  typically  tens  of  percent  (hun¬ 
dreds  at  extreme  sizes).  Most  of  the  diseconomies  just  identified  are  each  of 
this  magnitude.  Almost  any  conbination  of  a  few  of  them  could  tilt  the  economic 
bal ance  (for  all  but  highly  concentrated  applications)  toward  small  scale.  Thus 
there  is  a  prima  facie  case  that  big  technologies  may  not  be  inherently  cheaper, 
and  may  well  be  more  expensive,  than  those  scaled  to  dispersed  applications. 

Of  course,  there  are  tasks  for  which  big  systems  are  appropriate  and  cost- 
effective:  it  would,  for  example,  be  just  as  silly  to  run  a  big  smelter  with 
little  wind  machines  as  to  heat  houses  with  a  reactor.  Mismatching  scale  in 
either  direction  incurs  unnecessary  costs.  What  matters,  to  reemphasize  the 
point,  is  the  right  scale  for  the  particular  task.  But  even  in  our  highly  in¬ 
dustrialized  society,  nearly  all  the  energy-using  devices  are  smaller — most  of 
them  are  orders  of  magnitude  smaller — than  the  GW-scale  supply  systems  that  have 
hitherto  been  assumed  to  be  economically  essential.  We  have  sought  to  show  that 
a  more  sophisticated  and  comprehensive  view  of  the  economics  of  whole  energy 
systems  leads  to  a  very  different  balance  of  sizes  between  demand  and  supply. 

5.3.  Scale  and  speed. 

The  scale  of  energy  technologies  affects  not  only  their  cost  but  also  their 
speed  of  deployment — how  much  per  year,  or  per  dollar  invested,  they  can  raise 
the  rate  of  energy  supply.  While  the  forces  that  determine  actual  deployment 
rates  are  largely  political,  and  their  future  course  is  thus  somewhat  conjectur- 
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al,  there  are  theoretical  grounds  for  believing,  and  empirical  grounds  to 
confirm,  that  relatively  small  technologies  are  likely  to  be  built  faster,  in 
terms  of  total  energy  supplied,  than  conventional  large-scale  energy  techno¬ 
logies — provided  that  strong  obstacles  are  not  deliberately  put  in  their  way. 

It  may  at  first  seem  counterintuitive  to  suggest  that  doing  many  small 
things  may  be  quicker  than  doing  a  few  big  things.  It  is  certainly  contrary  to 
the  thrust  of  official  energy  policy.  It  seems  to  be  contradicted  by  one's 
sense  of  the  tangible  importance  of  a  large  refinery  or  power  plant.  Yet  in  a 
deeper  sense,  the  success  of  the  free-market  economic  philosophy  on  which 
American  private  enterprise  has  been  built  depends  very  directly  on  the  speed 
and  efficiency  of  many  individually  small  decisions  by  sovereign  consumers.  It 
is  precisely  because  those  decisions  work  faster,  better,  and  more  accurately  in 
giving  practical  effect  to  private  preferences  that  Americans  have  opted  for  a 
market  system — one  of  decentralized  choice  and  action — rather  than  for  a 
centrally  planned  economy  on  the  Soviet  model.  And  in  energy  policy,  this 
selection  has  been  rewarded;  for  today  those  individual  decisions  in  the  market¬ 
place — decisions  to  use  energy  more  efficiently — are,  in  aggregate,  affecting 
the  national  energy  picture  two  orders  of  magnitude  faster  than  all  the  big 
supply  projects  put  together.  (We  shall  offer  data  to  this  effect  below.) 

Despite  this  success,  many  energy  planners  are  reluctant  to  rest  their 
confidence  in  these  individual  actions — because  such  actions  are  not  under  the 
planners'  direct  control  as  a  large  construction  project  is  (or  is  supposed  to 
be).  Yet  exactly  the  same  mechanisms  are  at  work  in  individuals'  small  actions 
to  increase  their  energy  efficiency  that  have  always  been  invoked  as  the  ration¬ 
ale  for  forecasting  growth  in  energy  demand.  The  countless  small  market  deci¬ 
sions  which  collectively  constitute  national  demand  are  simply  responding  to  a 
different  set  of  signals  than  they  did  previously.  The  bottom  line  is  the  same: 
numerous  small  actions  by  people  plugging  steam  leaks,  weatherstripping  doors, 
and  buying  more  efficient  cars  are  adding  up  to  the  fastest-growing  contribution 
to  national  energy  supplies. 

Our  comparison  of  the  speed  of  actions  at  different  scales  will  center 
around  two  kinds  of  relatively  small-scale  technologies:  those  for  increasing 
the  productivity  of  using  energy  and  for  capturing  rer^wable  energy  flows.  We 
shall  describe  those  technologies'  nature,  status,  and  economics  in  Chapter  6 
and  in  Chapter  7  respectively.  (Analogous  arguments  also  apply  to  fossil- 
fueled  technologies  of  similar  scale,  such  as  fuel  cells  and  cogeneration 
devices.)  But  our  argument  here  is  really  about  scale,  not  hardware,  and  so  should 
logically  precede  a  fuller  development  of  the  details  of  the  devices  themselves. 
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The  scale  and  simplicity  of  all  these  devices  gives  them  several  advantag¬ 
es  which  should  enable  them  to  provide  needed  energy  services  faster,  per  unit 
of  investment,  than  larger  and  more  complex  alternatives.  First,  each  unit 
takes  days,  weeks,  or  months  to  install,  not  a  decade.  Secondly,  those  units 
can  diffuse  rapidly  into  a  large  consumer  market — like  digital  watches,  pocket 
calculators,  CB  radios,  and  snowmobiles — rather  than  requiring  a  slower  process 
of  "technology  delivery"  to  a  narrow,  specialized,  and  perhaps  "dynamically 
conservative"  utility  market  (like  1-GWe  power  plants  or  basic  oxygen  furna¬ 
ces).  This  is  a  function  of  the  relative  understandabi 1 ity,  marketability,  and 
accessibility  of  the  technologies — of  their  comparative  technical  and  manageri¬ 
al  simplicity  and  how  easily  they  can  adapt  to  local  conditions.  These  factors 
determine  the  mechanism  and  hence  the  rate  of  market  penetration. 

Technologies  that  can  be  designed,  made,  installed,  and  used  by  a  wide 
variety  and  a  large  number  of  actors  can  achieve  deployment  rates  (in  terms  of 
total  delivered  energy)  far  beyond  those  predicted  by  classical  market-penetra¬ 
tion  theories.  For  illustration,  let  us  imagine  two  sizes  of  wind  machines:  a 
unit  of  several  MWe  peak  capacity,  which  can  be  bought  for  perhaps  $1  million 
and  installed  by  a  heavy-engineering  contractor  in  a  few  months  on  a  specially 
prepared  utility  site;  and  another  of  a  few  kWe,  which  can  be  bought  by  a 
farmer  on  the  Great  Plains  from  Sears  or  Western  Auto,  brought  home  in  a  pickup 
truck,  put  up  (with  one  helper  and  hand  tools)  in  a  day,  then  plugged  into  the 
household  circuit  and  left  alone  with  virtually  no  maintenance  for  20-30  years. 
(Both  these  kinds  of  wind  machines  are  now  entering  the  U.S.  market.)  Most 
analysts  would  emphasize  that  it  takes  a  thousand  small  machines  to  equal  the 
energy  output  of  one  big  one  (actually  less,  because  the  small  ones,  being 
dispersed,  are  collectively  less  likely  to  be  simultaneously  becalmed  [Kahn 
1979;  Sorensen  1979].)  But  it  may  also  be  important  that  the  small  machines 
can  be  produced  far  faster  than  the  big  ones,  since  they  can  be  made  in  any 
vocational  school  shop,  not  only  in  elaborate  aerospace  facilities,  and  are 
also  probably  cheaper  per  kW.  What  may  be  most  important — and  is  hardly  ever 
captured  in  this  type  of  comparison — is  that  there  are  three  orders  of  magni¬ 
tude  more  farms  than  electric  utilities  on  the  Great  Plains*,  subject  to  fewer 
institutional  constraints  and  inertias. 

The  third  reason  for  suspecting  that  many  small,  simple  things  should  be 
faster  to  do  than  a  few  big,  complicated  things  is  that  the  former  are  slowed 
down  by  diverse,  temporary  institutional  barriers — passive  solar  by  the  need  to 
retread  architects  and  builders,  microhydro  by  licensing  problems,  greenhouses 
by  zoning  rules,  etc. — which  are  largely  independent  of  each  other.  In  con- 

*Likewise,  California  has  four  main  utilities  but  >200,000  rural  wind  sites 
with  ready  capacity  >10  kW  [Congressional  Research  Service  1979:113). 
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trast,  Large  and  complicated  plants  are  slowed  down  by  generic  constraints 
everywhere  at  once,  such  as  major-facility  siting  problems  and  large-project 
financing.  Because  of  their  independence,  dozens  of  small,  fairly  slow-growing 
investments  can  add  up,  by  strength  of  nunbers,  to  very  rapid  totaL  growth,  ra¬ 
ther  chan  being  held  back  by  universal  problems.  To  stop  the  big  plants  takes 
only  one  insolubLe  institutional  snag;  to  stop  all  the  diverse  kinds  of  small 
plants  takes  a  great  many.  This  diversity  of  renewable  and  efficiency  options 
is  not  only  a  good  insurance  policy  against  technical  failure;  it  also  helps  to 
guard  against  specialized,  unforeseen  social  problems  in  implementation,  offer¬ 
ing  a  prospect  of  alternative  ways  to  evade  what  problems  do  arise. 

The  theoretical  advantages  of  these  smaller  technologies  are  borne  out  in 
practical  experience.  The  fastest  gains  in  U.S.  energy  supply  have  come  from 
small  efficiency-improving  technologies.  During  1973-78,  the  U.S.  already  got 
twice  as  much  energy-''suppLying"  capacity  from  numerous  small  energy-saving 
actions,  twice  as  fast,  as  synfuel  advocates  say  they  can  provide  at  ten  times 
the  cost  (if  they  are  given  $22  billion  to  get  started  with)*.  In  1979,  98%  of 
U.S.  economic  growth  was  fueled  by  energy  savings,  only  2%  by  actual  expansions 
of  net  energy  suppLy;  thus  millions  of  individual  actions  in  the  marketplace, 
by  people  trying  to  save  energy  to  save  money,  outpaced  the  centrally  planned, 
Long-Lead-t ime  supply  projects  by  better  than  fifty  to  one.  In  1980,  while 
real  GNP  stayed  constant  within  better  than  0.1%,  total  U.S.  energy  use  dropped 
by  3.2%.  (Danes  decreased  their  direct  fuel  use  by  20%  just  in  the  two  years 
1979-80,  largely  through  better  thermal  insulation  of  buildings.) 

This  trend  is  accelerating.  Americans  spent  some  $8.7  billion  on  small 
energy-saving  devices  in  1980  and  are  expected  to  spend  tens  of  billions  of 
dollars  per  year  by  the  mid-1980s  [Business  Week  1981].  Sant  et  al .  [1981] 
have  shown  that  $100  billion  per  year  would  be  economically  worthwhile.  Supply 
industries,  used  to  the  far  slower  progress  to  which  their  complex  technologies 
with  ten-year  lead  times  have  confined  them,  have  been  caught  unprepared  by  the 
efficiency  boom,  and  many  utilities  and  oil  companies  are  now  suffering  finan¬ 
cial  hardship  as  sales  unexpectedly  decline.  (There  are  some  silver  linings, 
however:  some  of  Royal  Dutch-Shell's  most  profitable  subsidiaries  sell  energy¬ 
saving  and  -managing  services.  This  is  proving  an  extremely  high-return  enter¬ 
prise:  one  such  firm,  started  in  1979,  expects  $250  million  turnover  in  1983.) 

Small-scale  renewable  sources  are — after  efficiency  improvements — the  sec¬ 
ond-fastest-growing  part  of  U.S.  energy  supply  [ RTM  198)].  During  1977-80,  re¬ 
newables  gave  America  1.2  quads  of  new  primary  energy  while  the  total  contribu¬ 
tion  from  nonrenewables  fell  by  0.6  quads  [_i_d  .  ]  .  A  few  illustrations: 

*Likewise  in  the  EEC,  increased  energy  efficiency  in  1973-78  supplied  more 
than  ten  times  as  much  new  energy  capacity  as  increased  nuclear  power.  The 
ratio  of  energy  savings  to  net  supply  increases  was  95:5  [St.  Geours  1979]. 
Japan  has  had  an  average  growth  rate  of  4%/y  in  real  GNP  since  1974,  yet  at 
the  same  time  has  experienced  essentially  zero  growth  in  total  energy  use. 


-  The  U.S.,  which  already  gets  over  7%  of  its  primary  energy  from  renewab¬ 
les  (mainly  hydroelectricity)  [RTM  1981],  now  has  about  half  a  million  solar 
buildings,  of  which  half  are  passive  and  half  those  are  retrofits  (mainly  green¬ 
houses,  plus  some  glazing  of  exterior  masonry  walls  to  form  Tronbe  walls).  Many 
of  these  were  built  on  the  basis  of  word-of-mouth  or  popular- journal  informa¬ 
tion,  few  from  officially  provided  information.  In  the  most  solar-conscious 
areas,  about  6-7%  of  all  space  heating  is  solar,  and  25-100%  of  the  new  housing 
starts  are  passive  solar  designs.  Nationally,  about  15%  of  the  contractors 
building  tract  houses,  and  virtually  all  purveyors  of  prefabricated  and 
package-planned  houses,  now  offer  thermally  efficient,  passive  solar  designs. 

-  In  New  England,  over  150  factories  have  switched  from  oil  to  wood,  as 
have  more  than  half  the  households  in  many  rural  (and  some  suburban)  areas. 
Private  woodburning  has  increased  more  than  sixfold  in  the  past  few  years,  and 
the  nunber  of  stove  foundries  has  risen  from  a  handful  to  more  chan  400.  Pri¬ 
vate  and  industrial  woodburning  in  1980  supplied  the  U.S.  with  about  twice  as 
much  delivered  energy  as  nuclear  power  did  [Lovins  &  Lovins  1981 :66nl44] . 

-  There  are  over  40  main  wind-machine  conpanies.  Commercial  windfarms  are 
conpeting  on  utility  grids,  and  more  are  being  rapidly  built  (pp.  246-7). 

-  Some  10-20  GWe  of  small  hydro  capacity  is  under  reconstruction  (mainly 
refurbishing  old,  abandoned  dams).  A  further  20  GWe  at  2000  sites  awaited  per¬ 
mits  in  mid-1980  [Ron  Corso,  FERC,  personal  communication,  4  August  1 981 ] — 
twice  the  gross  nuclear  capacity  ordered  since  1975.  Companies  to  build  micro¬ 
hydro  or  resell  power  to  utilities  are  springing  up  [Siegel  1981 ](p.  245). 

-  There  are  over  a  thousand  retail  outlets  for  Gasohol®,  and  most  states 
have  biomass  fuel  programs. 

In  short,  it  is  hard  to  find  a  part  of  the  U.S.  that  does  not  have  its  unique 
blend  of  renewable  energy  ferment.  Many  observers  who  travel  the  country 
remark  that  although  these  activities  are  concealed  from  governments'  view  by 
their  dispersion,  small  individual  scale,  and  diversity,  they  add  up  to  a  quiet 
energy  revolution  that  is  reshaping  the  American  energy  system — like  the  Japan¬ 
ese*  (Tsuchiya  1981] — with  unprecedented  speed. 

From  the  vantage  point  of  the  five  years  or  so  in  which  this  revolution 
has  been  well  underway,  it  may  seem  that  the  results  are  meager.  But  so  it 
must  have  seemed  in  1900  when  there  were  about  5000-8000  cars  on  U.S.  roads,  or 
even  in  1908  when  there  were  194,000.  Cars  became  more  noticeable  in  1911  when 
the  600,000  on  the  roads  caused  Standard  Oil  to  sell  for  the  first  time  more 
gasoline  than  kerosene.  Two  years  later  there  were  a  million  cars;  seventeen 
years  after  that,  in  1930,  23  million;  today,  over  100  million.  In  the  first 
decade  after  World  War  I,  the  automobile  became  sufficiently  widespread  to 

*Japan's  primary  energy  is  7.2%  renewable  (cf.  8%  officially  forecast  for 
1995)  including  0.8%  direct  solar,  with  >$500  million  worth  of  collectors 
(750,000  for  water  heating,  13.000  for  process  heat)  sold  in  1980  alone. 


F/6  15/3 


AD-A108  263 
UNCLASSIFIED 


FRIENDS  OF  THE  EARTH  INC  SAN  FRANCISCO  CA 
ENERGY  POLICIES  FOR  RESILIENCE  AND  NATIONAL  SECURITY. (U) 

OCT  81  A  B  LOVINS#  L  H  LOVINS  DCPA01-79-C-0317 

NL 


179 


transform  at  first  the  perceptions  of  mobility  and  later,  in  consequence,  the 
settlement  patterns  and  the  whole  industrial  infrastructure  of  American  socie¬ 
ty.  Yet  the  car  may  not  at  first  have  seemed  so  portentous:  indeed,  on  the 
assumption  (common  in  the  early  twentieth  century)  that  car  drivers  would  have 
to  pay  for  their  highways  just  as  railroads  had  had  to  pay  for  their  railbeds, 
the  odds  seemed  stacked  against  the  commercial  success  of  the  car.  Until  the 
Model  A  and  Model  T  brought  cars  to  every  town,  few  observers  expected  rapid 
success.  Thus  profound  changes  in  the  technostructure  of  America  can  creep  up 
on  us  unawares.  Small  energy  technologies — for  efficient  use  and  renewable 
supply — may  well  be  repeating  the  story. 

Nobody  can  say  for  sure  whether  they  will  ultimately  work  such  a  transfor¬ 
mation.  But  they  certainly  have  the  technical,  economic,  and  social  potential 
to  do  so.  As  the  Office  of  Technology  Assessment  concluded  (1978]: 

If  energy  can  be  produced  from  on-site  solar  energy  systems  at  competitive 
prices,  the  increasing  centralization  which  has  characterized  the 
equipment  and  institutions  associated  with  energy  industries  for  the  past 
30  years  could  be  drastically  altered;  basic  patterns  of  energy 
consumption  and  production  could  be  changed;  energy-producing  equipment 
could  be  owned  by  many  types  of  organizations  and  even  individual 
homeowners.  Given  the  increasing  fraction  of  U.S.  industrial  assets  which 
are  being  invested  in  energy  industries,  tendencies  toward  centralization 
of  many  aspects  of  society  could  also  be  affected. 

As  we  shall  see  in  subsequent  Chapters,  small  technologies  for  energy  efficien¬ 
cy  and  renewable  supply  already  meet  the  test  of  "competitive  prices."  Even  in 
1979,  before  many  further  improvements  had  persuaded  such  institutions  as  the 
Southern  California  Edison  Company  to  pursue  aggressively  an  efficiency/renew¬ 
ables  strategy  as  the  cheapest  option,  a  distinguished  panel  found  [Aspen  Ins¬ 
titute  for  Humanistic  Studies  1979:Summ,2]  that  "Decentralized  [electricity] 
generation  systems  are  likely  to  confer  major  consumer  benefits.  These  may 
include  shorter  lead  times  in  planning  and  construction,  easier  siting,  reduced 
capital  requirements,  greater  efficiency  in  fuel  use,  and  reduced  vulnerability 
to  fuel  shor tages . . . . We  find  a  number  of  such  options  are  at,  or  are  approach¬ 
ing,  a  state  of  technical  and  economic  competitiveness  with  larger  centralized 
systems."  The  panel  also  found  that  "On  balance ,... the  climate  for  the  devel¬ 
opment  of  small,  diversified,  and  dispersed  supply  and  [eff iciency] .. .options 
is  likely  to  improve."  Small,  whether  beautiful  or  not,  is  at  least  serious. 

For  these  reasons,  it  now  appears  to  many  analysts  that  a  fundamental 
shift  in  the  architecture  of  America's  energy  system  may  be  underway,  with 
profoundly  encouraging  implications  for  resilience  and  national  security.  We 
explore  next  the  most  important  element  of  that  transformation:  the  dramat ic 
and  continuing  increase  in  national  energy  efficiency. 
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6.  END-USE  EFFICIENCY:  MOST  RESILIENCE  PER  DOLLAR 


Although  concerns  about  energy  vulnerab i 1 i t v  are  usually  stated  in  terms 
of  interruptions  of  energy  supply,  e.g.  oil  imports  or  electrical  deliveries, 
what  is  really  of  concern  is  not  the  protection  of  energy  supplies  but  rather 
of  the  tasks  that  the  energy  performs  after  it  is  delivered.  There  is  no 
demand  for  energy  per  se .  Raw  kilowatt-hours,  or  barrels  of  sticky  black  goo, 
are  not  a  useful  commodity.  Energy  is  not  an  end  in  itself  but  only  a  means  of 
providing  energy  services — comfort,  mobility,  light,  ability  to  make  steel  or 
bake  bread.  If  a  given  service  can  be  provided  with  no  energy — as  a  house  can 
be  space-conditioned  passively  if  it  is  built  properly — then  for  that  task, 
there  is  no  energy  supply  to  be  interrupted,  hence  no  energy  vulnerabil ity.  In 
a  more  typical  case,  some  energy  is  required  to  provide  a  desired  service,  but 
the  amount  of  energy  is  not  fixed:  it  can  be  reduced  by  increasing  the  end-use 
ef f ic iency  of  the  service,  so  that  the  same  service  is  performed,  with  un¬ 
changed  reliability  and  convenience,  using  less  energy.  Thus  it  is  not  true 
that  the  more  energy  we  use,  the  better  off  we  are.  The  optimum  is  rather  to 
use  the  amount  (and  the  type  and  source)  of  energy  that  will  provide  each 
desired  service  in  the  cheapest  way. 

Improving  energy  efficiency  may  require  extra  investment  in  money,  brains, 
or  attention.  From  an  economic  point  of  view,  one  must  decide  how  much  invest¬ 
ment  to  wring  more  work  out  of  one's  energy  will  be  cheaper  than  investments  to 
provide  additional  energy  supplies.  This  balance  may  not  coincide,  however, 
with  that  dictated  by  vulnerability  concerns,  because  measures  to  increase  end- 
use  efficiency  will  in  general  be  less  vulnerable  than  measures  to  increase 
supply.  Roof  insulation  and  heat  exchangers  simply  cannot  be  disrupted  in  the 
same  way  as  oil  tankers  and  transmission  lines.  Moreover,  as  we  shall  show, 
efficiency  improvements  often  reduce  the  end-user's  vulnerability  to  disruption 
of  the  remaining  energy  supplies,  even  though  they  are  only  reduced  in  quanti¬ 
ty,  not  changed  in  source.  For  these  reasons,  including  the  social  cost  of 
vulnerability  will  tend  to  tilt  the  optimal  balance  away  from  new  supply  and 
toward  efficiency.  As  a  conservatism,  however,  this  discussion  will  consider 
only  the  narrtxv  economic  viewpoint  of  direct  (private  internal)  costs,  and  will 
confine  itself  to  those  efficiency  improvements  which  cost  less  than  correspon¬ 
ding  increases  in  energy  supply.  Most  of  the  improvements  we  consider  are  also 
cost-effective  at  present  energy  prices,  which  "roll  in"  costly  new  supplies 
with  cheaper  old  supplies  and  thus  understate  the  "marginal"  cost  of  increasing 
supplies.  Thus  our  economic  comparisons,  by  counting  only  direct  costs,  impli- 
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citiy  value  all  risks,  vulnerabilities,  and  side-effects  at  zero.  By  pursuing 
least  economic  cost,  however,  we  shall  fortuitously  achieve  major  improvements 
in  energy  resilience. 

Many  energy  preparedness  planners  are  unused  to  dealing  with  energy  effi¬ 
ciency.  Their  day-to-day  concern  is  the  other  way  of  "saving"  energy — doing 
without  it  and  hence  curtailing  the  services  it  provides.  Efficiency  gains  are 
commonly  considered  to  be  a  gradual,  long-term  process  that  is  the  task  of 
energy  policy;  in  this  view,  if  an  energy  shortage  does  strike,  it  is  too  late 
for  anything  but  belt-tightening.  Emergency  energy  planning  thus  tends  to 
focus  on  allocating  scarce  supplies  in  a  spot  shortage  so  that  critical,  high- 
priority  needs  can  still  be  met — if  still  at  low  levels  of  energy  efficiency. 

We  consider  here  the  opposite  approach:  seeking  to  reduce  or  eliminate  the 
risk  of  shortages  by  increasing  end-use  efficiency,  in  advance  of  any  shortage, 
to  levels  which  provide  a  generous  "cushion"  of  both  normal  and  emergency 
energy  supplies.  By  doing  more  with  less,  it  may  be  possible  to  avoid  having 
to  do  without.  Insulating  the  roof  may  avoid  freezing  in  the  dark. 

Improving  end-use  efficiency  offers,  we  shall  argue,  the  best  buy  in  ener¬ 
gy  resilience — to  paraphrase  an  old  Pentagon  slogan,  the  "most  bounce  per 
buck."  Its  benefits  arise  at  all  scales,  from  that  of  the  individual  user  to 
that  of  a  nation  or  the  world.  These  benefits  are  multiple,  synergistic  (the 
total  benefit  is  greater  than  the  sum  of  its  parts),  and  nonlinear  (small 
improvements  buy  a  disproportionate  amount  of  insurance).  To  explore  them,  we 
begin  with  a  brief  survey  of  available,  cost-effective  measures  to  raise 
end-use  efficiency. 

6.1.  The  state  of  the  art. 


Improvements  in  U.S.  energy  efficiency  in  the  past  eight  years  have  been 
remarkable.  They  were  largely  responsible  for  decreasing  net  U.S.  imports  of 
oil  (crude  oil  plus  refined  products)  from  9.0  million  barrels  per  day  in  1977 
to  8.7  in  1978,  8.4  in  1979,  6.0  in  1980,  and  about  5.4  in  mid-1981 — well  below 
the  6.3  of  1973.  A  group  of  oil  industry  leaders  forecast  in  1980  that,  con¬ 
trary  to  their  expectations  in  1978,  total  U.S.  demand  for  refined  products 
will  probably  stay  about  constant  through  the  1980s  [Los  Angeles  Times  1980), 
with  demand  for  gasoline,  home  heating  oil,  and  residual  fuel  oil  actually 
falling.  So  far  events  have  improved  on  those  projections.  In  California 
--which  uses  over  10%  of  all  U.S.  gasoline — there  were  nearly  a  million  more 
cars  in  1980,  driven  almost  10  billion  vehicle-miles  further,  than  in  1976,  yet 
gasoline  use  in  1980  was  the  lowest  since  1976  [Bill i ter  1981a;  Los  Angeles 


T irnes  1981 j].  For  the  entire  U.S.,  gasoline  demand  in  March  1981  was  the  low¬ 
est  in  ten  years.  Declining  total  oil  demand  became  the  rule,  not  the  excep¬ 
tion — so  it  was  news  when,  in  January  1981,  unusually  cold  weather  led  to  the 
first  increase  in  national  oil  use  in  two  years  [Los  Angeles  Tiroes  1981k). 

These  figures  are  encouraging,  but  they  do  not  instantly  reveal  their 
cause.  Such  aggregated  figures  as  net  oil  inports  lump  together  domestic 
demand  with  domestic  oil  extraction  and  interfuel  substitution.  Aggregated 
demand  data  cannot  distinguish  between  changes  in  the  energy  intensity  of  pro¬ 
viding  the  same  services  and  changes  in  the  composition  of  services  provided 
(since  some,  like  smelting,  need  far  more  energy  than  others,  such  as  banking); 
between  changes  in  efficiency  and  changes  in  total  economic  activity;  between 
inproved  efficiency  and  degradation  of  energy  services  (e.g.  reduced  comfort  in 
buildings);  and  between  better  progress  in  some  sectors  (notably  industry)  and 
worse  progress  in  others.  Such  aggregated  measures  as  energy/GNP  ratios  or 
levels  of  net  oil  imports  are  thus  not  suitable  for  comparing  energy  efficien¬ 
cies  over  time  or  between  countries.  These  measures  cannot  reveal  either  how 
much  end-use  efficiency  has  been  inproved  or  how  much  improvement  is  still  pos¬ 
sible  and  worthwhile.  For  those  purposes,  the  only  practical  approach  is  to 
assess  "technical  coefficients" — how  much  energy  is  used,  in  physical  units,  to 
provide  a  precisely  specified  unit  of  each  energy  service. 

In  the  past  few  years,  a  large  international  literature  has  assessed  what 
these  coefficients  currently  are  and  what  they  can,  with  economic  advantage,  be 
changed  to  under  a  wide  range  of  conditions.  These  data  can  be  transferred 
from  one  place  to  another  if  careful  attention  is  paid  to  differences  of  cli¬ 
mates,  of  preferences  in  the  size  and  performance  of  cars,  in  the  different 
kinds  of  ore  fed  into  steel  mills,  etc.  The  technical  literature  on  practically 
achievable  efficiency  gains  is  so  vast  and  so  fast-moving  that  it  would  not  be 
feasible  in  a  study  of  this  length  to  summarize  even  all  its  main  results.  We 
have  attempted  this  elsewhere,  most  recently  in  a  study  originally  commissioned 
by  the  West  German  government  [Lovins,  Lovins,  Krause,  &  Bach  1981).  Two 
authoritative  analyses  based  almost  entirely  on  the  U.S.  literature  [Sant  et  al . 
1981;  SERI  1981)  have  reached  similar  conclusions  in  even  greater  detail.  For 
present  purposes,  however,  it  is  sufficient  to  survey  typical  developments  in 
just  a  few  key  sectors.  Those  not  treated  here  in  detail  are  analogous. 

6.1.1.  Bu ildings . 

The  80  million  dwellings  in  the  United  States,  using  altogether  about  35% 
of  all  U.S.  primary  energy  demand,  were  mainly  built  before  1970,  when  real 
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energy  prices  were  low  and  falling  lower,  giving  no  incentive  to  build  effi¬ 
ciently.  During  the  1970s,  under  the  spur  of  air-conditioning  bills  that 
sometimes  exceeded  mortgage  payments  and  annual  household  energy  costs  which, 
in  New  England,  trebled  from  $386  in  1970  to  $1325  in  1980  [Washington  Post 
1981a],  the  average  thermal  efficiency  of  American  houses  was  improved  by  at 
least  15%.  But  by  1978,  the  houses  still  required  about  13  BTU  of  fuel  (com¬ 
pared  to  16  in  1970)  to  heat  one  square  foot  of  floorspace  through  ont<  Fahren¬ 
heit  degree-day  of  outdoor  coldness  (13  BTU/ft^-DDF  is  about  265  kJ/m^- 
DDC)  [Rosenfeld  et  al .  1980] .  (This  assumes  a  70%-ef ficient  furnace.  Actual 
furnace  efficiencies  are  often  lower,  but  this  should  be  dealt  with  separately 
from  the  thermal  efficiency  of  the  house  itself.) 

The  state  of  the  art  in  cost-effectively  efficient  houses,  however,  is  ten 
to  a  hundred  times  better  than  that:  it  is  not  13  but  0-1.3  BTU/ft^-DDF. 

This  can  be  achieved  by  various  combinations  of  "super insulated"  tight  con¬ 
struction  and  passive  solar  gain  (capturing  and  storing  solar  heat,  even  on 
cloudy  days,  in  the  fabric  of  the  house  itself,  e.g.  through  south-facing 
windows).  (We  do  not  consider  here  other  techniques,  such  as  double-envelope 
or  earth-tempered  construction,  for  achieving  the  same  aim.)  "Superinsulated" 
houses  in  a  cold  climate  typically  have  about  a  foot  of  insulation  in  the  walls 
(say  R-40) ,  two  feet  in  the  roof  (R-60),  double  or  triple  glazing,  insulated 
night  shutters,  and  virtually  airtight  construction,  with  plenty  of  fresh  air 
provided  by  mechanical  ventilation  through  a  simple  air-to-air  heat  exchanger, 
which  can  recover  about  80%  of  the  heat  or  coolth  in  the  outgoing  air.  These 
techniques  reduce  the  gross  heat  loss  through  the  shell  of  the  house  so  far 
that  the  internal  heat  gains — from  windows,  occupants,  lights,  and  appliances — 
provide  most  or  all  of  the  space  heating.  Such  supplementary  heat  as  may  be 
needed  in  an  especially  unfavorable  climate  is  so  small — much  smaller  than  the 
heat  needed  for  domestic  hot  watei — that  it  can  be  provided  by  slightly 
increasing  the  south  window  area,  taking  surplus  heat  from  a  slightly  oversized 
solar  water-heater,  burning  a  newspaper  or  a  few  sticks  in  a  small  stove  on 
rare  occasion,  or  keeping  one  or  two  40-watt  poodles.  Such  houses  have  lower 
life-cycle  cost  (and  often  lower  construction  cost)  than  normal  houses,  look 
the  same,  can  be  built  in  any  style,  provide  a  higher  standard  of  comfort  than 
normal  houses — less  noise,  less  dirt,  no  drafts,  excellent  temperature  stabili¬ 
ty — and  do  not,  if  properly  designed,  require  any  significant  changes  in  the 
occupants'  behavior. 

The  examples  most  often  cited  for  such  construction  are  the  Saskatchewan 
Conservation  House  (considered  in  more  detail  below) — and  its  hundreds  of 
successors  in  Canada  and  the  U.S. — and  the  Illinois  Lo-Cal  design.  Both  types 
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are  being  routinely  built  by  tract-housing  contractors;  the  governments  of 
Canada,  Saskatchewan,  and  Alberta  have  spread  the  necessary  building  informa¬ 
tion  so  effectively  (University  of  Saskatchewan  1979)  that  there  should  be  over 
a  thousand  such  houses  finished  by  the  end  of  1982,  even  though  the  first  one 
was  finished  only  in  December  1977.  The  Saskatchewan  design  had  in  1980  a  net 
additional  capital  cost  of  7-8%  (about  US$2600  or  less),  paying  back  in  about 
four  years  against  the  present  OPEC  oil  price — and  the  price  was  falling  in 
real  terms  as  contractors  gained  experience.  The  net  extra  capital  cost  of  the 
Lo-Cal  design  was  at  most  about  $1000,  and  in  some  houses,  e.g.  those  of  Phelps 
and  Leger,  it  was  reportedly  zero  or  negative:  the  saving  from  not  having  to 
install  a  furnace  more  than  paid  for  the  additional  insulation,  etc. 

[ Rosenfeld  et  al .  1980;  Shurcliff  1980;  Leger  &  Dutt  1979;  Shick  1980].  The 
measured  net  space-heating  fuel  requirements  to  maintain  comfort  in  these 
houses  are  respectively  0.8  BTU/ft^-DDF  for  the  Saskatchewan  Conservation 
House,  l.l  for  Phelps,  and  1.3  for  Leger  (Rosenfeld  et  al .  1980],  These 
figures  are  not  only  10-16  times  better  than  the  U.S.  average  (13);  they  are 
also  better  than  any  present  or  proposed  U.S.  building  standard.  The  widely 
used  ASHRAE  90-75  code  yields  about  10.7  BTU/ft^-DDF;  the  HUD  1974  Minimum 
Property  Standard,  about  9.6;  typical  1976-79  U.S.  building  practice,  about 
6.8;  the  Building  Energy  Performance  Standard  (BEPS)  proposed  in  1979,  about 
4.4;  and  a  proposed  "strict  BEPS,"  about  2.3.  No  BEPS  standard  has  been  enac¬ 
ted  or  is  being  actively  considered  at  present,  even  though  houses  exceeding 
its  "strict"  version  would  probably  cost  less  to  build  than  normal  houses. 

Although  these  highly  efficient  designs  have  most  of  their  window  area 
facing  more  or  less  south,  and  little  or  none  on  the  north  side,  they  are  not 
really  intended  to  be  good  passive  solar  designs.  With  proper  passive  solar 
techniques  which  are  no  costlier  than  super insulat ion  and  may  be  cheaper,  the 
levels  of  insulation  needed  for  similar  or  better  performance  can  be  consider¬ 
ably  relaxed.  The  right  combination  of  thermal  efficiency  and  passive  solar 
gain  can  reduce  net  space-heating  requirements  to  essentially  zero  (<0.1  BTU/ 
ft^-DDF)  in  climates  worse  than  that  of  Chicago  (SERI  1981:1:31],  at  a 
total  extra  capital  cost  of  at  most  about  $2000 — paying  back  in  <4  years  at  the 
1981  OPEC  oil  price  or  in  <2  years  at  the  1981  average  residential  electricity 
price.  An  added  benefit  of  many  passive  solar  designs  is  a  "sunspace" — extend¬ 
ed  living  space  that  is  bright  and  comfortable  even  on  cloudy  winter  days,  and 
in  which  fresh  food  can  be  grown  year-round  in  severe  climates.  The  optimal 
balance  between  superinsulat ion  and  passive  design  is  normally  rather  broad, 
and  depends  on  local  climate,  construction  practice,  and  architectural  taste. 


185 


The  same  measures  that  reduce  heating  loads  also  reduce  air-conditioning 
loads  by  not  letting  the  house  get  hot  in  the  first  place.  Additional  measures 
include  window  shades  and  overhangs  and  coatings,  trees,  roof  ponds,  and  earth- 
pipe  cooling  (a  cheap,  effective  form  of  passive  air  conditioning).  And  the 
energy  savings  are  not  confined  to  space  heating  and  cooling.  A  combination  of 
water-efficient  appliances  and  recovery  of  waste  heat  from  outgoing  "graywater" 
(from  dishwashing,  washing  machines,  showers,  etc.,  but  not  including  sewage) 
can  generally  cut  the  water-heating  load  in  half  [Carter  &  Flower  1981].  Most 
if  not  all  of  these  measures  are  cost-effective  at  the  present  world  oil  price, 
and  all  are  cost-effective  against  electrical  or  synfuel  prices. 

Intelligent  redesign  of  household  appliances  can  reduce  their  average  use 
of  electricity  by  three-  to  four-fold  [ N<Srgard  1979,1979a]  with  an  average 
payback  time  under  6  years  at  the  present  average  U.S.  residential  electricity 
price — all  with  no  change  in  performance  or  convenience.  An  average  U.S.  frost- 
free  refrigerator,  for  example,  uses  about  1700  kW-h/y;  Amana  has  a  675-kW-h/y 
prototype;  the  best  1981  Japanese  models  use  about  400  (for  the  same  size); 
under  200  is  cost-effective  today. 

The  efficiency  improvements  that  can  be  made  in  space  heating  and  cooling, 
water  heating,  lights,  and  appliances  are  often  even  larger  and  cheaper  in  the 
commercial  sector  (offices,  hotels,  churches,  schools,  hospitals,  etc.)  than  in 
houses.  Many  office  buildings  were  designed  to  be  cooled  and  heated  simultan¬ 
eously,  and  most  of  their  cooling  load  is  to  take  away  the  heat  of  overlighting 
(i.e.  at  headache  level).  Just  the  difference  in  lighting  intensity  between 
offices  built  in  the  early  1970s  (about  4  W/ft^)  and  in  1980  (2  W/ft^) 
would  by  2000  eliminate  the  need  for  150  1-GWe  power  plants  [SERI  1981:1:54- 
55].  The  average  U.S.  office  building  in  1978  used  over  340,000  BTU  of  total 
resource  energy,  as  direct  fuels  plus  power-plant  fuels,  to  space-condition, 
light,  and  otherwise  operate  a  square  foot  of  floorspace.  Hydro  Place,  a  glass 
utility  headquarters  in  Toronto,  uses  170,000;  Gulf  Canada  Square  in  Calgary, 
about  117,000;  the  best  office  buildings  now  nearing  completion  in  Canada,  20- 
30,000.  All  these  designs  have  payback  times  of  a  few  years. 

So  far  we  have  described  only  new  buildings.  But  most  of  the  buildings 
that  the  United  States  will  have  over  the  next  half-century  are  already 
standing,  so  the  main  focus  must  be  on  retrofitting  (fixing  up)  those  existing 
stocks.  Extensive  data  are  available  [SERI  1981;  Carhart  et  al .  1980]  on  the 
empirical  cost  and  performance  of  retrofits.  Most  of  the  techniques  described 
above  can  be  applied,  with  minor  modifications,  to  existing  buildings.  Some 
Canadian  builders  remove  the  siding  from  a  frame  house,  build  out  the  eaves  and 
casings,  add  a  vapor  barrier  and  superinsulat ion,  and  put  the  siding  back  on, 
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cost-effectively  cutting  the  space-heating  load  by  90%  or  more.  Where  this 
operation  was  combined  with  adding  extensions  to  houses,  it  could  be  done  for 
only  about  C$3000 — less  than  the  cost  of  enlarging  the  furnace  [Palmiter  & 
Miller  1979]  .  Ingenious  techniques  for  retrofit  have  been  developed  for  a  wide 
range  of  construction  styles.  It  is  common  in  Europe  even  to  add  exterior 
insulation  and  a  new  facade  on  masonry  walls,  trapping  their  large  heat-storing 
capacity  or  "thermal  mass"  inside  and  so  stabilizing  the  building  temperature. 
Even  elaborate  measures  of  this  kind,  in  countries  (such  as  Sweden  and  FR 
Germany)  which  have  the  world's  highest  labor  costs,  specific  costs  of  retrofit 
several  times  U.S.  levels,  and  relatively  efficient  buildings  to  start  with, 
are  cost-effective  at  present  OPEC  oil  prices  (Lovins,  Lovins,  Krause,  &  Bach 
1981:23].  In  well-planned  programs,  retrofits  to  tighten  and  insulate  U.S. 
houses  or  commercial  buildings  have  cost  about  $  1 / f 1 2  of  floorspace,  or 
about  $6-7/bbl  (15^/gal)  of  equivalent  oil  savings  [SERI  1981:24-27,65].  This 
cost  applies  for  savings  of  more  than  two-thirds  of  the  original  average  energy 
use.  Even  subopt imal  programs — such  as  those  which  plug  only  visible  air  leaks 
in  houses  rather  than  pressure-testing  to  find  hidden  leaks,  or  which  use  storm 
windows  rather  than  insulating  shades  and  other  cost-effective  window  treat¬ 
ments— cost  about  $19/bbl  (40^/gal)  [SERI  1981:1:27] — still  highly  competitive 
with  OPEC  crude  oil  at  $34/bbl,  synfuel  at  $40-80/bbl  (1979-$  plant-gate  price 
assigning  $34/bbl  oil  price)  [Congressional  Research  Service  1981]  ,  or  electri¬ 
city  at  $90-120/"bbl"  of  heat  content. 

6.1.2.  Transportation. 

Two-thirds  of  America's  transportation  energy,  and  over  half  of  all  U.S. 
oil  use,  goes  to  cars.  The  cars  average  about  16  miles  per  U.S.  gallon  (mpg), 
the  light  trucks  nearer  12.  Technical  improvements  in  the  engine  and  drive 
train,  lubricants,  tires,  streamlining,  and  bearings  can  improve  these  figures 
to  80-110  mpg  for  a  4-passenger  car  of  about  the  same  size  and  performance  as 
the  average  1981  domestic  model  [SERI  1981;  Gray  &  von  Hippel  1981;  TRW  1979; 
Shackson  &  Leach  1980] .  The  total  cost  of  improvements  to  60  mpg  is  $800-2260 
per  car  [Shackson  &  Leach  1980;  Gorman  &  Heitner  1980;  SERI  1981]  ,  correspond¬ 
ing  to  a  payback  time,  at  the  present  gasoline  price,  between  one  year  and 
three  and  a  half  years. 

Some  manufacturers  are  already  well  on  the  way  to  these  goals.  A  VW 
diesel  Rabbit"1  already  averages  about  40  mpg  on  the  road;  average  1981-model 
Japanese  cars  get  42-45  mpg  on  the  road;  VW  has  prototyped  a  turbocharged  diesel 
Rabbit”1  which  has  a  60  mpg  EPA  composite  rating,  meets  all  emission  standards, 
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accelerates  0-60  mph  in  13.5  seconds,  and  is  safe  in  a  40-mph  head-on  crash  [VW 

of  America  1980].  Most  impressively,  an  advanced  VW  diesel  prototype  with  a 

Rabbit”  body  and  a  3-cylinder  engine  which  turns  off  on  idle  or  coast,  then 
immediately  restarts  on  acceleration — a  car  for  which  VW  had  claimed  on-road 

composite  efficiency  of  80  mpg  (Seiffert  &  Walzer  1980] — was  recently  tested  by 

the  EPA  at  80  mpg  city,  100  mpg  highway.  (On-road  mileage  in  real  driving 
cycles  will  probably  average  over  80  mpg.)  Even  these  empirical  achievements 
do  not  exhaust  the  possibilities  offered  by  series  hybrid  drives,  infinitely 
variable  transmissions  (being  introduced  in  1981-82  by  Borg-Warner/Fiat) ,  etc. 

It  is  important  to  note  that  these  60-90  mpg  achievements  do  not  even  con¬ 
sider  another  option — using  cars  move  specialized  for  their  tasks,  notably 
2-seater  commuter  cars  for  the  vast  majority  of  personal  driving.  Such  cars 
are  selling  well  in  many  other  countries  [Boyle  1981;  Lehner  1980;  Japan  Auto¬ 
motive  News  1980],  especially  the  Japanese  "mini-cars,"  measuring  no  bigger 
than  4.5  by  10.5  feet  and  displacing  no  more  than  550  cc,  but  currently  captur¬ 
ing  over  20%  of  the  domestic  market  in  highly  urbanized  Japan.  Their  attrac¬ 
tion  is  that  some  models  get  on-road  efficiencies  of  53  mpg  city,  75  highway. 
(In  contrast,  GM's  newly  announced  diesel  Chevette  gets  only  40/55  mpg.)  Such 
designs  offer  a  good  match  to  the  urban  driving  needs  of  many  Americans,  and 
with  modern  crushable-foam  materials,  can  be  safer  than  conventional  cars.  Mix¬ 
ing  commuter  mini-cars  into  the  fleet  could  send  fleet  averages  over  100  mpg. 

Straightforward  application  of  proven  and  cost-effective  technology  can 
reduce  the  specific  energy  requirements  of  heavy  trucks  and  buses  by  30-40%  and 
of  railroads  by  about  25%.  New  Japanese  ship  designs  have  cost-effectively 
saved  about  50%  of  normal  fuel  requirements.  Commercial  aircraft  (7%  of  U.S. 
transportation  fuel  use)  have  improved  their  fleet  efficiency  from  17.5  passen¬ 
ger  miles  per  gallon  in  1973  to  25  today  and  will  reach  45  once  the  new  genera¬ 
tion  of  aircraft  has  been  fully  introduced  (Boeing  757  and  767,  DC9-80,  and 
advanced  L— 1011) — a  45%  improvement  in  fuel  efficiency.  Even  larger  savings 
are  available  from  new  technologies  for  turbofan  engines,  special  propeller  and 
wing  designs,  active  control  technologies,  and  weight-saving  materials;  togeth¬ 
er  these  promise  a  saving  of  about  70%. 

6.1.3.  Industry  [SERI  1981;  Sant  et  al.  1981;  Lovins  et  al.  1981]. 

The  ten  most  energy-intensive  U.S.  industries  during  1972-79  decreased 
their  energy  consumption  per  unit  of  product  by  an  average  of  15.4%  [Energy 
Insider  1981] — almost  entirely  by  measures  paying  back  within  one  or  two  years 
at  the  then  current  rolled-in  fuel  prices.  The  efficiency  of  using  process 


heat  (about  43%  of  all  industrial  energy)  rose  by  about  4%  per  year.  But  there 
is  still  cost-effective  scope  for  saving  at  least  a  third  more  heat  by  better 
thermal  insulation,  heat  recovery,  process  controls,  heat  pumps,  cogeneration, 
and  use  of  best  available  processes.  Alumina  smelters  can  likewise  save  at 
least  a  third  of  their  electrical  input  by  adopting  superior  processes  (Alcoa, 
Pechiney).  Proper  sizing,  coupling,  and  controls  would  save  about  half  of  the 
electricity  needs  for  industrial  motors  (27%  of  all  industrial  primary  energy 
use);  this  one  improvement,  typically  paying  back  in  a  few  years,  would  more 
than  displace  every  nuclear  power  plant  in  the  country.  Innovative  industrial 
processes  even  more  efficient  than  we  have  just  stated  are  being  rapidly 
developed,  such  as  a  new  process  which  saves  over  three-quarters  of  the  energy 
needed  to  make  ethylene.  A  substantial  fraction  of  industrial  energy  can  also 
be  saved  by  more  efficient  use,  recycling,  and  remanufacturing  of  materials. 

Whether  efficiency  in  each  sector  is  improved  all  the  way  to  these  cost- 
effective  levels  or  only  partway,  the  improvement  benefits  energy  resilience  at 
the  scale  of  both  the  user  and  the  whole  society.  We  consider  these  in  turn. 

6,2,  Micro  benefits. 

Increased  end-use  efficiency  decreases  the  vulnerability  of  energy  users, 
at  the  scale  of  an  individual  household,  office,  shop,  or  factory,  in  four  main 
ways:  longer  time  constants,  limiting  extreme  behavior,  shaving  peak  loads,  and 
displacing  marginal  supplies.  (The  last  of  these  can  be  considered  a  micro  or 
a  macro  effect  or  both,  so  this  section  inevitably  overlaps  somewhat  with  the 
following  one.) 

The  concept  of  making  failures  happen  more  slowly  in  order  to  give  more 
time  in  which  to  respond  is  familiar  in  preparedness  planning.  It  is  the 
strategy  of  a  person  who  puts  containers  of  water  in  the  freezer  as  a  "thermal 
flywheel"  so  that  in  a  power  failure,  the  freezer  temperature  will  rise  only 
slowly  and  cannot  exceed  the  freezing  point  until  all  the  ice  has  melted.  It 
is  the  strategy  of  a  smelting  company  that  insulates  its  pot  lines  to  slow  down 
their  heat  loss,  so  that  if  the  electric  current  that  keeps  the  alumina  and 
cryolite  molten  is  only  briefly  interrupted,  they  will  remain  molten.  (The 
alternative — months  of  work  chipping  them  out  with  chisels — is  so  unpleasant 
that  it  is  worth  buying  a  lot  of  insulation.)  It  is  the  strategy  of  stockpil¬ 
ing,  but  improved:  an  energy  system  which  uses  oil  more  slowly  to  provide  the 
same  energy  services  is  better  than  one  which  uses  more  oil  but  draws  down  a 
stockpile  in  ca*  of  sup'  .  interruption,  because  while  the  stockpile  costs 
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money  to  maintain  and  finance,  the  more  efficient  energy  system  saves  money  all 
the  time,  whether  there  is  an  interruption  or  not. 

Let  us  consider  a  very  localized,  specific  example  of  lengthening  time 
constants:  a  super  insulated  house  [Besant  et  al .  1978;  Dumont  et  al .  1978].  The 
Saskatchewan  Conservation  House  is  in  Regina  at  60.5°  N. latitude  in  a  fierce 
climate — 10,800  DDF/y,  a  design  temperature  (expected  extreme  cold)  of  -290F, 
and  average  insolation  of  162  W/m^  (about  10%  less  than  the  U.S.  average). 

It  is  a  two-story  frame  box  with  2000  ft^  Gf  floorspace,  R-40  walls  (offset 
double  two-by-fours),  R-60  roof,  a  tight  6-mil  vapor  barrier  with  infiltration 
less  than  5%  air  change  per  hour,  an  80%-eff icient  air-to-air  heat  exchanger 
averaging  0.6  air  changes  per  hour  (more  can  be  provided  if  desired),  double 
glazing  downstairs,  triple  glazing  upstairs,  insulated  night  shutters,  an  air¬ 
lock  entrance,  and  insulated  door  and  foundation  slab.  As  a  result  of  these 
highly  cost-effective  measures,  the  total  heat  loss  through  the  shell  of  the 
house  is  only  38  watts  per  F°  of  temperature  difference  between  inside  and 
outside  when  the  window  shutters  are  closed  (55  with  them  open,  45  average) . 

The  gross  shell  loss  totals  only  41.2  million  BTU/y.  But  after  allowance  for 
the  "free  heat"  from  windows,  people,  lights,  and  appliances,  the  net  space 
heating  load  is  only  5  million  BTU  (1400  kW-h)/y — less  than  4%  as  big  as  for  an 
ordinary  Regina  house  the  same  size*.  Furthermore,  the  superinsulated  house  has 
a  solar  system  big  enough  to  cover  all  of  its  space  and  water  heating  needs, 
using  no  backup;  yet  that  solar  system  contains  only  190  ft^  of  collectors 
(9.5%  of  the  floor  area)  and  15.3  yd^  (3090  gal)  of  water  storage  (2.8%  of 
the  house  volume).  Most  studies  would  predict  that  five  to  ten  times  this  area 
and  volume  would  be  necessary  to  cover  even  two-thirds  of  the  space-  and  water¬ 
heating  load.  How,  then,  can  the  smaller  system  be  big  enough? 

It  is  in  answering  this  question  that  we  see  how  profoundly  the  efficiency 

improvements  have  altered  the  basic  physics  of  the  house.  An  ordinary  house 

requires  sharp  peaks  of  heat  to  maintain  its  inside  temperature  whenever  the 

weather  turns  cold.  These  peaks  often  exceed  10  kW  even  in  a  mild  California 

climate  (Kahn  1979:316],  and  in  an  ordinary  Regina  house  they  would  be  many 

tens  of  kW,  requiring  either  a  large  furnace  or  (with  electric  heating) 

installed  generation,  transmission,  and  distribution  capacity  costing  about  as 

much  as  the  house  itself.  In  contrast,  the  Saskatchewan  Conservation  House 

holds  in  its  heat  so  effectively  that  even  with  a  99  F0  temperature  difference 

across  the  shell — +70*F  inside  and  -29°F  outside — the  interior  temperature  can 

be  maintained  with  only  3.7  kW  of  total  heat  supply  if  the  shutters  are  closed 

or  5.5  kW  if  they  are  open.  Thus  the  super insulat ion  and  the  air-to-air  heat 

exchanger  have  reduced  the  space-heating  load  from  a  series  of  huge  peaks  to  a 

*Besant  et  al.  [1979]  report  12.5  MMBTU  [Rosenfeld  et  al.  1980]  in  1978-79, 
due  to  air  leakage  around  the  shutters  and  the  net  heat  loss  from  ca.  1000 
visitors/wk,  but  expect  to  return  to  "about  5"  with  "some  further  work." 
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series  of  small  blips  superimposed  on  a  water-heat ing  baseload.  The  average 
heat  requirement  is  three  times  as  big  for  heating  domestic  water  as  for  heat¬ 
ing  the  whole  house,  even  though  the  water-heating  load  has  itself  been  reduced 
by  a  third  by  recovering  heat  from  graywater.  To  cover  the  greatly  truncated 
peaks  of  space-heating,  far  less  collector  area  and  storage  volume  is  needed. 

Secondly,  although  the  house  has  "low  thermal  mass" — it  can  store  heat 
only  in  its  light  frame  construction,  so  its  heat  capacity  is  only  23,700  BTU/ 
F° — its  "time  constant"  (the  time  it  would  take  for  the  inside  to  fall  63.2%  of 
the  way  to  the  outside  temperature  if  no  heat  were  provided  from  any  source)  is 
about  100  hours,  or  about  four  times  as  long  as  for  a  normal  house  of  similar 
construction.  The  Saskatchewan  Conservation  House  stores  no  more  heat,  but 
loses  it  far  more  slowly.  For  delaying  the  drop  in  temperature,  this  is 
exactly  equivalent.  Such  a  house  provides  inherent  protection,  because  if  its 
heating  system  fails,  a  spell  of  cold  weather  is  likely  to  have  moderated  be¬ 
fore  the  inside  temperature  drops  far.  For  example,  in  0°F  weather,  the  house 
would  tale  34  hours  to  drop  to  50° F  in  total  darkness.  Under  the  conditions 
least  favorable  for  passive  solar  gain  through  the  windows — averaging  787  W  in 
December — the  house  would  probably  take  several  weeks  to  get  as  low  as  50° F, 
and  temperatures  much  below  that  would  be  physically  impossible  unless  the 
tightness  of  the  house  were  somehow  seriously  damaged.  Thus  if  the  house  had 
no  working  furnace,  baseboard  heaters,  solar  collector,  or  any  other  external 
heat  source,  an  occupant  willing  to  tolerate  an  English  rather  than  an  affluent 
North  American  standard  of  comfort  (say  55-60°F  in  cold  weather)  could  go  right 
through  the  Canadian  winter  without  even  realizing  there  was  no  heating  system. 

This  behavior  illustrates  both  the  stretched  time-constant  of  the  house — 
everything  happens  in  slow  motion — and  its  inherent  limitation  of  extreme  beha¬ 
vior  .  Any  properly  built  passive  solar  house  cannot  get  below  about  50-55°F  no 
matter  what.  Even  a  badly  built  passive  solar  greenhouse,  provided  it  has  a 
reasonable  amount  of  thermal  mass  (rocks,  masonry,  drums  of  water,  etc.)  for 
overnight  heat  storage,  will  never  get  below  freezing,  even  in  a  Minnesota 
climate.  So  robust  are  structures  of  this  kind  that  in  one  Massachusetts 
passive  building,  when  vandals  broke  down  the  door  and  left  a  hole  of  2-3 
yd^  through  the  coldest  night  of  the  winter,  the  interior  temperature  still 
stayed  above  60°F.  (That  building  did  not  have  insulating  night  shades,  which 
would  have  stretched  its  time  constant  from  days  to  weeks.)  It  is  also  note¬ 
worthy  that  the  Saskatchewan  house's  heat-storage  tank,  spanning  its  full  90  F° 
temperature  range,  would  supply  space  and  water  heating  at  the  annual  average 
rate,  with  no  heat  input,  for  48  days — just  like  having  a  full  3000-gallon  oil 
tank  in  a  normal  house,  or  a  tenth  of  the  normal  inventory  of  a  heating-oil 
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distributor  [Congressional  Research  Service  1977:1:248].  A  gallon  of  the  hot 
water  stores  only  0.5%  as  much  energy  as  a  gallon  of  oil,  but  serves  about 
equally  well  because  so  much  less  energy  is  required  to  do  the  same  task. 

A  third  important  result  of  the  Saskatchewan  Conservation  House's  superin¬ 
sulation  is  that  heat  can  only  diffuse  inside  the  house — it  can  scarcely  get 
out.  The  inside  of  the  house  is  in  almost  perfect  convective  and  radiative 
equilibrium.  Thus  any  point  source  of  heat,  such  as  one  short  section  of  unin¬ 
sulated  hot-water  pipe,  can  heat  the  whole  house  evenly  without  requiring  a 
heat  distribution  system.  In  this  way  an  Alaskan  superinsulated  house  can  be 
evenly  heated  by  a  tiny  stove  putting  out  a  few  hundred  watts  in  one  corner, 
yet  have  uniform  temperatures  within  about  a  degree  even  to  its  furthest  cor¬ 
ner,  far  away  around  labyrinthine  corridors.  This  means  that  if  normal  heating 
fails,  a  superinsulated  house  can  be  heated  amply  by  any  small,  improvised  heat 
source — a  small  wood-  or  trash-burner,  a  camping  stove,  a  small  lantern.  The 
heat  thus  provided  will  provide  comfort  throughout  the  house,  whereas  in  a 
normal  house  with  a  failed  heating  system  one  would  have  to  huddle  over  a  large 
stove  to  try  to  keep  a  single  room  habitably  warm. 

In  short,  the  efficiency  of  this  model  house  (quite  aside  from  its  use  of 
solar  energy)  makes  its  occupants  virtually  invulnerable  to  heating  failures. 
Their  neighbors,  who  would  be  in  serious  trouble  in  a  fraction  of  a  winter  day 
without  heat,  can  take  shelter  in  the  efficient  house  and  by  doing  so  can  pro¬ 
vide  enough  body  warmth  to  heat  the  whole  house.  If  there  are  more  than  one  or 
two  neighbors,  excess  heat  will  have  to  be  vented  by  opening  the  windows!  If 
the  failure  affected  the  heating  sources  of  all  houses,  the  occupants  of  the 
superinsulated  house  might  find  out  only  from  the  arrival  of  their  chilled 
neighbors  that  anything  was  wrong;  left  to  their  own  devices,  they  would  prob¬ 
ably  not  notice  for  weeks  that  their  heating  system  was  out  of  order,  and  then 
the  signal  would  be  a  drop  from  68-72°C  to  perhaps  55-60°F,  not  a  catastrophic 
drop  to  sub-freezing  or  subzpro  temperatures  indoors.  As  in  the  Aachen  house 
in  Germany  (four  times  less  efficient,  yet  physically  incapable  in  an  average- 
weather  year  of  getting  below  55°F  inside  with  no  space  heating  whatever),  the 
occupants  of  such  a  house  would  be  all  but  invulnerable  to  energy  disruptions. 

Long  time  constants  are  not  always  a  blessing.  A  Swedish  superinsulated 
house  took  about  two  years  to  attain  its  design  efficiency  because  its  building 
materials  had  been  left  outdoors  and  wetted  by  rain.  The  house  needed  so 
little  heating  that  it  took  that  long  to  dry  out  the  materials.  Likewise,  a 
large  seasonal-storage  tank  for  a  community  district  heating  system  could 
easily  take  a  year  to  "charge  up"  to  normal  working  temperatures — though  once 
heated,  it  would  "coast"  indefinitely  thereafter.  Thus  long-time-constant 
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energy  systems  must  be  in  place  before  an  energy  shortage  strikes.  But  if 
working  then,  they  are  likely  to  outlast  the  shortage  and  vastly  increase  the 
flexibility  of  possible  responses. 

The  ability  of  either  wel l- insulated  buildings  with  some  passive  gain  or 
badly  insulated  buildings  with  strong  passive  gain  to  protect  under  all  circum¬ 
stances  against  low  (especially  sub- f reez  ing)  temperatures  means  that  activi¬ 
ties  such  as  greenhouse  gardening  can  be  guaranteed  to  work  year-round  anywhere 
south  of  the  Arctic  Circle.  Year-round  passive-solar  greenhouse  gardening, 
even  using  tropical  species,  has  proven  highly  successful  even  in  parts  of  the 
U.S.  that  have  a  three-month  growing  season  outdoors.  Another  advantage  is 
that  even  a  very  crude,  unglazed  solar  water  heater — such  as  a  piece  of  black¬ 
ened  sheet-metal  attached  to  a  hot-water  pipe — can  work  well  inside  such  a 
greenhouse.  Being  always  protected  from  freezing  by  the  thermal  mass  and  solar 
gain  re lat ionsh i ps  of  the  greenhouse,  the  solar  water  heater  needs  none  of  the 
anti-frost  precautions  (draindown  valves,  double  antifreeze  loops  with  heat 
exchangers,  etc.)  which  can  make  conventional  outdoor  solar  water  heaters  rela¬ 
tively  complex  and  expensive. 

6.3,  Macro  benefits. 

The  foregoing  examples  have  shown  how  a  more  thermally  efficient  house  can 
reduce  its  occupants'  vulnerability  by  lengthening  time  constants,  preventing 
extremes  of  temperature,  and  making  small,  improvised  sources  much  simpler, 
more  flexible,  and  more  effective.  But  the  house  is  only  a  microcosm  for  the 
entire  American  energy  system. 

A  60-mpg  car,  for  example,  can  be  driven  four  times  as  many  miles  or  days 
as  a  standard  car  on  the  same  amount  of  fuel.  It  can  therefore  canvas  a  con¬ 
siderably  larger  area  in  search  of  fuel,  or  be  four  times  as  likely  to  stay  on 
the  road  long  enough  for  improvised  supplies  of  liquid  fuel  to  be  arranged*. 
Stockpiles  of  all  kinds  last  four  times  as  long,  yet  this  fourfold  expansion 
effectively  incurs  negative  extra  carrying  charges  because  of  the  cash-flow  of 
the  cars'  fuel  saving  in  normal  operation. 

An  efficient  car  "frees  up"  three  such  cars'  worth  of  fuel;  that  is,  given 
some  constrained  amount  of  available  fuel,  four  times  as  many  car-miles  can  be 


*Its  engine  may  also  be  more  suitable  than  most  for  using  unconventional 
fuels,  as  mentioned  in  Chapter  7:  the  Boat  Division  of  Chalmers  in  Sweden  has 
even  reportedly  burned  wood  flour  successfully  in  large  diesels.  Given  ade¬ 
quate  lubrication,  diesels  tend  to  be  less  particular  about  their  fuel  than 
ordinary  Otto-cycle  engines. 
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driven  if  the  cars  get  60  mpg  as  if  they  get  15.  Visits  to  the  filling  station 
become  four  times  as  infrequent.  The  1.5  billion  gallons  of  fuel  stored  in 
vehicles  fuel  tanks  (61%  full)  in  August  1979  [Energy  Information  Adminis¬ 
tration  1981]  would  constitute  a  reserve  capable  of  powering  a  60-mpg  fleet  of 
130  million  cars  and  light  trucks  for  nearly  700  miles  each,  or  four  weeks' 
driving  at  the  average  August  1979  rate.  Thus  the  dynamics  of  any  fuel  short¬ 
age  would  be  dramatically  different  than  with  cars  that  nust  be  refueled  every 
few  days.  With  such  a  fleet,  mobility  would  be  undiminished  even  if  several 
major  oil  pipelines,  refineries,  and  ports  suddenly  disappeared.  Fuel  reserves 
"in  the  pipeline"  between  the  wellhead  and  the  gas  pump  would  last  not  for  a 
few  months  but  for  a  year  or  more — plenty  of  time  to  arrange  improvised  biomass 
liquid  fuel  supplies  large  enough  to  run  essential  services  if  not  virtually 
the  whole  fleet  (Chapter  7).  For  the  first  time,  stockpiles  "in  the  pipeline" 
would  last  for  about  as  long  as  it  takes  to  repair  major  damage  to  pipelines, 
ports,  etc.,  so  the  country  could  withstand  considerable  destruction  of  oil 
facilities  without  shortages  or  the  need  for  interim  rationing. 

Similar  advantages  would  arise  with  electricity.  Just  as  a  house  that  is 
thermally  efficient  can  provide  most  or  all  of  its  needs  with  "free  heat,"  so 
one  that  is  electrically  efficient  can  rely  only  on  the  most  uninterruptable 
components  of  supply,  local  renewables  and  grid  hydroelectricity.  Of  course,  a 
household  (in  most  U.S.  climates)  really  concerned  with  saving  electricity  will 
have  not  an  electric  refrigerator  but  a  seasonal-storage  icebox — a  superinsula- 
ted  box  which  is  filled  with  several  yd3  of  water  each  autumn  from  a  garden 
hose,  then  allowed  to  freeze  (via  a  removable  panel  of  insulation)  and  spend 
the  rest  of  the  year  melting  out  through  a  drain-hole.  Food  on  the  other  side 
of  a  partition  from  the  large  block  of  ice  will  not  spoil  even  in  a  permanent 
power  failure.  But  even  an  efficient  conventional  refrigerator,  using  a  few 
hundred  kW-h/y  instead  of  the  present  average  of  1440,  will  itself  warm  up  very 
slowly,  because  its  efficiency  derives  partly  from  excellent  thermal  insulation. 
The  week  or  more  it  will  keep  cool  without  power  offers  enough  breathing-space 
to  hook  up  an  improvised  power  supply  or  direct  mechanical  drive,  using  perhaps 
a  car  or  bicycle.  The  installed  generating  capacity  of  generators  and  alterna¬ 
tors  in  U.S.  cars  and  trucks  is  over  100  GWe — a  sixth  as  much  as  in  the  entire 
national  grid — and,  with  present  hydroelectricity,  would  probably  be  enough  to 
meet  all  national  electrical  needs  if  electricity  were  used  at  a  cost-effective 
level  of  technical  efficiency  (Appendix  A).  If  the  stock  of  end-use  devices 
were  economically  efficient,  essential  household  needs — food  preservation, 
lighting,  radio  (Goen  et  al .  1970:83] — would  average  only  about  50  W,  rather 
than  the  present  300-500  W.  This  t i nv  power  demand  could  he  provided  hy  a  nr 
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battery  with  a  small  inverter,  a  tiny  inprovised  wind  machine,  or  a  solar-cell 
array  of  a  few  square  yards.  If  the  average  car  battery  has  a  100-A-h  capacity 
(§12  VDC  and  is  kept  half-charged,  the  national  fleet's  batteries  store  of  order 
60  GW-h — enough,  after  inverter  losses,  to  meet  all  national  electrical  demands 
at  current  efficiencies  for  a  quarter  of  an  hour,  but  enough  to  meet  essential 
household  needs  at  high  efficiency  for  about  half  a  day*.  In  many  comnuni t ies , 
an  industrial  cogenerator  or  microhydro  set  that  is  currently  a  small  fraction 
of  total  supply  could  meet  all  essential  needs  for  efficient  end-use  devices, 
even  if  that  town's  grid  were  completely  isolated.  In  most  places,  standard 
improvised  power  sources  [Foget  &  Van  Horn  1969;  Black  1971],  such  as  motors 
driven  backwards  by  car  and  truck  engines,  would  suffice  to  continue  life 
pretty  much  as  usual.  As  in  a  superinsulated  house,  the  stretched  time-con¬ 
stants  and  the  greater  scope  for  improvised  supply  would  make  energy  efficien¬ 
cy  the  key  to  energy  resilience. 

If  this  pattern  of  efficient  end-use  devices  were  widespread,  baseload 
power  from  hydro,  cogeneration,  etc.  could  be  wheeled  for  very  long  distances 
without  straining  regional  interties,  and  petroleum-dependent  peaking  plants 
would  not  have  to  be  fired  up.  Fuel  stockpiles  for  any  required  thermal  plants 
or  cogenerators  would  be  greatly  stretched;  indeed,  cogenerators  with  flexible 
boiler  designs  would  often  be  able  to  run  on  locally  available  wastes.  Greater 
cogeneration  in  oil  refineries  and  chemical  plants  (most  of  which  should  be  net 
exporters  of  electricity),  besides  being  economically  profitable,  increases  the 
plants'  self-reliance  and  ability  to  serve  local  users  in  grid  failures. 

Additional  peak-shaving  measures  can  produce  similar  benefits  in  both 
routine  and  emergency  operation.  Peak-shaving  cooperatives  [Energy  &  Defense 
Project  1980:156],  expanded  power  brokerage  among  utilities  (successfully  used 
in  Florida),  and  utility  payments  to  communities  for  peak-shaving  (as  by 
Pacific  Gas  &  Electric)  are  among  the  institutional  mechanisms  proven  in  the 
past  few  years.  During  the  1977-78  coal  strike,  DOE  curtailment  of  uranium 
enrichment  shaved  about  3  GWe  off  the  regional  electric  load;  since  enriched 
uranium,  aluminum,  and  other  electricity-intensive  products  are  easier  to  store 
than  electricity  itself,  the  existence  of  such  processes  in  the  load  mix  offers 
further  load  flexibility,  with  the  carrying  charge  on  idled  plant  operations 
often  nuch  lower  than  the  marginal  cost  of  peaking  power  today. 

*lf  12  VDC  could  be  used:  most  household  devices  currently  use  117  VAC, 
though  small  inverters  for  recreational  use  are  cheap  and  fairly  common.  Future 
homes  wired  for  low-voltage  DC,  e.g.  from  photovoltaics,  would  use  DC  end-use 
devices,  and  if  these  were  compatible  with  standard  car  electrical  voltages, 
flexibility  of  emergency  supply  would  be  greatly  increased. 
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Among  the  most  important  benefits  of  energy  efficiency  to  the  nation  and 
to  the  individual  consumer  is  the  displacement  of  marginal  supplies.  That  is, 
efficiency  improvements  can  provide  unchanged  energy  services  not  only  with 
less  total  energy,  but  with  less  in  particular  of  the  energy  that  comes  from 
the  costliest  or  most  vulnerable  sources.  Thus,  decreases  in  total  oil  con¬ 
sumption  would  normally  be  reflected  as  decreases  in  the  use  of  oil  from  the 
least  attractive  source — OPEC  and  other  imports. 

This  thesis  is  easily  illustrated  by  arguing  that  U.S.  oil  imports  can  be 
eliminated  by  about  1990  by  two  relatively  simple  measures,  neither  of  which 
has  been  seriously  considered  in  Federal  energy  policy.  The  prescription  is 
distressingly  simple:  stop  living  in  sieves  and  stop  driving  Petropigs.  The 
sieves  (buildings)  are  so  leaky  that  just  basic  weatherizat ion  and  insulation 
of  American  buildings  could  save  over  2.5  million  bbl/d  of  oil  and  gas  by  1990, 
at  an  average  cost  of  about  $6-7/bbl,  and  a  similar  amount  at  a  similar  price 
during  1990-2000  [Ross  &  Williams  1979;  SERI  1981]*.  The  Petropigs  (gas-guz¬ 
zling  cars  and  light  trucks),  however,  are  a  more  complex  problem. 

Gas-guzzlers  have  such  a  low  trade-in  value  that  they  have  been  trickling 
down  to  low-income  people  who  can  afford  neither  to  run  nor  to  replace  them. 
These  cars  are  thus  remaining  in  the  stock  longer  when  they  should  be  turning 
over  faster.  (This  is  especially  damaging  because  fleet  efficiency  is  a  geo¬ 
metric,  not  an  arithmetic,  average:  a  fleet  which  is  80%  60  mpg  and  20%  10  mpg 
has  an  average  efficiency  of  30  mpg,  not  50  mpg.)  Just  as  buildings  can  be 
fixed  up  faster  if  efficiency  loans  from,  say,  utilities  (Appendix  A)  relieve 
people  of  the  up-front  capital  burden,  so  gas-guzzlers  can  be  replaced  faster 
if  investment  that  would  otherwise  go  to  increase  energy  supplies  were  instead 
loaned  or  given  out  for  car  replacement.  For  example^: 

-  Rather  than  spending  $20  billion  (plus  perhaps  $68  billion  later)  to 
subsidize  synfuel  plants  which  will  probably  never  be  competitive  even  with  oil 
at  any  particular  price  [Congressional  Research  Service  1981],  the  U.S.  could 
save  more  oil  faster  by  using  some  of  the  same  money  to  pay  at  least  half  the 
cost  of  buying  people  a  diesel  Rabbit"  or  equivalent--provided  they  would  scrap 
their  Brontomobile  to  get  it  off  the  road.  (It  cannot  just  be  traded  in, 
because  then  someone  else  might  drive  it;  it  must  be  recycled  and  a  death 
certificate  provided  for  it.) 


♦Special  mechanisms  are  available  for  accelerating  retrofits  [id.].  That 
used  by  Canadian  utilities  to  retrofit  metropolitan  Toronto  and  Montreal  from 
25-  to  60-Hz  electricity — fleets  of  specially  equipped  vans  modifying  all  the 
end-use  devices  in  each  neighborhood,  one  at  a  time — could  also  be  used,  by  the 
public  or  private  sector,  to  tighten,  insulate,  and  solarize  buildings. 

+The  supporting  calculations  have  been  published  elsewhere  [Lovins  1981b]. 
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-  Alternatively,  the  U.S.  could  get  a  5-year  or  shorter  average  payback 
against  synfuels  by  paying  people  at  least  $200  for  every  mpg  by  which  a  new 
car  improves  on  a  scrapped  one.  (People  who  scrap  a  gas-guzzler  and  do  not 
replace  it  should  get  a  corresponding  bounty  for  it.) 

-  Instead  of  merely  redirecting  synfuel  subsidies  into  better  buys,  as  in 
the  two  preceding  examples,  it  would  be  still  better  to  abolish  the  subsidies 
and  use  a  free-market  solution.  The  U.S.  car  industry  plans  to  spend  of  the 
order  of  $50  billion  on  retcoling  during  1985-95  [von  Hippel  1981:101).  If  in 
addition  the  industry  spent  as  implausibly  large  a  sum  as  $100  billion  extra 
during  the  1980s — probably  enough  to  rebuilt  Detroit — on  retooling  to  convert 
the  average  car  made,  in  one  giant  leapfrog,  to  60  mpg — 20-30  mpg  worse  than 
the  best  prototypes  today — and  then  spread  that  marginal  retooling  cost  over  a 
new  U.S.  fleet  of  cars  and  light  trucks,  then  the  average  cost  would  average 
$770  per  vehicle,  and  buyers  would  recover  that  cost  from  their  gasoline 
savings,  at  $1. 40/gal.,  in  14  months. 

The  trouble  with  this  last  illustration  is  that  Detroit  does  not  have  the 
money.  But  the  oil  industry  does,  and  is  currently  spending  it  on  extremely 
expensive  and  risky  drilling.  If  instead  Exxon  drilled  for  oil  in  Detroit, 
loaning  the  car-makers  money  for  retooling  to  state-of-the-art  efficiencies, 
everyone  would  be  better  off  (assuming  some  solution  to  the  obvious  antitrust 
problems),  and  Exxon  would  be  virtually  certain  of  finding  a  vast  pool  of  saved 
oil,  producible  (not  extractable)  at  over  5  million  bbl/d  for  under  $7/bbl. 

These  examples  are  perhaps  a  trifle  whimsical,  but  they  have  a  serious 
point.  Switching  to  a  60-mpg  fleet  of  cars  would  save  nearly  4  million  bbl/d — 
two-thirds  of  the  entire  1980  net  rate  of  U.S.  oil  imports,  greater  than  the 
imports  from  the  Gulf,  two  and  a  half  Alaskan  North  Slopes,  or  eighty  big 
synfuel  plants.  Similar  action  with  light  trucks  would  save  a  further  one  and 
a  half  million  bbl/d,  or  about  one  North  Slope*.  These  plus  weatherizat ion — in 
short,  just  the  two  biggest  oil-saving  measures — would,  if  pursued  for  a  decade 
or  so  to  a  level  well  short  of  what  is  technically  feasible  or  economically 
worthwhile,  more  than  eliminate  all  U.S.  oil  imports.  They  would  do  this 
before  a  power  plant  or  synfuel  plant  ordered  today  would  deliver  any  energy 
whatsoever,  and  at  about  a  tenth  of  its  cost.t 


*A  more  modest  shift  to  40  mpg  would  save  almost  3  million  bbl/d  in  cars  and 
1  million  bbl/d  in  light  trucks  [von  Hippel  1981:95). 
tThe  United  Auto  Workers  and  several  private  analysts  have  been  proposing  ac¬ 
celerated  scrappage  for  at  least  six  years.  The  Federal  government  has  not 
yet  paid  attention.  The  one  officially  sponsored  study  [Energy  4>  Environment¬ 
al  Analysis  1980)  used  such  artifically  restrictive  assumptions  that  savings 
were  very  small  and  expensive.  DOE's  supposedly  encyclopedic  survey  of  options 
[1980]  does  not  mention  the  possibility.  DOE's  senior  oi 1-backout  analysts 
had  not  done  even  back-of-the-envelope  arithmetic  about  it  by  November  1980. 
Even  Gray  &  von  Hippel  [1981]  omit  it,  although  they  expect  a  60-mpg  fleet 
by  about  2000  anyhow. 
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6.4.  Economic  priorities. 

It  may  be  argued  that  what  can  be  done  by  1990  is  not  a  sufficient  guide 
to  what  should  be  done  right  now.  By  way  of  further  illustration,  therefore, 
let  us  consider  five  ways  in  which  the  sum  of  $100,000  could  be  spent  to  reduce 
dependence  on  imported  oil  over  the  next  ten  years.  These  examples  are  not 
meant  to  be  sophisticated  calculat ions- -they  assume,  for  example,  that  real  oil 
prices  will  remain  constant,  and  they  do  not  discount  future  savings  (dollar 
amounts  are  all  in  real  1980  terms) — but  their  qualitative  point  is  clear. 

1.  Use  the  $100,000  as  seed  money  to  catalyze  a  door-to-door  citizen 
action  program  of  low-cost/no-cost  weather izat ion  in  particularly  leaky  build¬ 
ings.  (Such  a  program  does  net  involve  insulation,  but  only  plugging  obvious 
holes.  In  a  typical  U.S.  house  these  total  more  than  a  square  yard,  enabling 
the  wind  to  whistle  through  the  house.)  Such  seed  grants  totalling  $95,000 
were  in  fact  made  by  ACTION,  HUD,  DOE,  and  community-development  block- grant 
programs  to  the  industrial  town  of  Fitchburg,  Massachusetts  in  1979.  With  some 
imaginative  red-tape-cutting  by  ACTION  staff,  the  grants  led  to  the  establish¬ 
ment  of  ten  local  training  centers,  each  of  which,  between  October  and  Decem¬ 
ber,  ran  25-30  workshops  per  week,  each  lasting  about  45-90  minutes.  (The 
Boston  energy  office  is  now  planning  to  run  abbreviated  versions  on  rush-hour 
subway  platforms.)  The  Fitchburg  program  was  especially  directed  at  low-income 
people  (under  $14,000/y  for  a  family  of  four),  living  mainly  in  old,  2-  and  3- 
family  frame  houses.  Of  the  roughly  10,000  households  in  town,  1728  sent  some¬ 
one  to  a  workshop  and  received  a  free  retrofit  kit.  Volunteers  helped  with  in¬ 
stallation  where  needed.  About  1300-1400  houses  were  weatherized  in  ten  weeks 
— mostly  in  six  or  seven  weeks  after  word  got  around.  Each  weatherized  house¬ 
hold  saved  an  average  of  about  $350  in  the  first  winter.  The  total  oil  saving 
for  the  town  was  about  $615,000  in  the  winter  of  1979-80  alone.  (Using  this 
program  and  its  umbrella  organization — Fundamental  Action  to  Conserve  Energy — 
as  a  model,  similar  programs  were  established  the  following  year  in  several 
dozen  nearby  towns.)  From  this  example  we  find  that  investing  $100,000  (round¬ 
ing  up  from  the  actual  cost)  saves,  over  the  first  ten  years  alone,  about 
163,000  barrels  of  heating  oil,  corresponding  to  perhaps  180,000  barrels  of 
crude  oil,  at  an  average  cost  of  about  6li/bbl. 

2.  Use  the  $100,000  to  convert  44  cars,  by  replacement,  from  15  to  60  mpg 

(assuming  von  Hippel's  conservatively  high  marginal  cost  [SERI  1981]  of  $2263/ 

car:  the  actual  cost  is  almost  certainly  lower  than  that).  Each  car  will  save 

(if  driven  an  unchanged  10,000  mi/y)  500  gal/y  or  11.9  bbl/y  of  gasoline*, 

equivalent  to  about  13  bbl/y  of  crude  oil.  The  44  cars  over  10  years  will 

♦Actually  somewhat  less  for  replacement  at  the  margin,  since  the  average  car 
sold  in  the  U.S.  in  1981  has  an  on-road  efficiency  ca.  20  mpg,  not  15. 


therefore  save  a  cumulative  5830  bbL  of  crude  oil  at  a  cost  in  the  vicinity  of 
$19/bbl — about  the  same  as  for  inefficiently  executed  building  retrofits. 

3.  Invest  the  $100,000  by  buying  2940  barrels  of  OPEC  oil  at  $34/bbl,  put 
them  into  a  hole  in  the  ground,  and  call  it  a  Strategic  Petroleum  Reserve.  While 
sitting  there  the  oil  will  perforin  no  direct  energy  services,  but  will  presuma¬ 
bly  cushion  against  supply  interruptions  [Oeese  &  Nye  1981;  Davis  1981].  The 
annual  cost:  of  order  $l/bbl  for  storage  and  (currently)  $5-6/bbl  carrying 
charges.  After  10  years,  if  the  reserve  has  not  been  drawn  upon,  the  2940 
barrels  of  oil  will  still  be  there.  They  represent  an  investment  cost  of  $34/ 
bbl  which  is  probably  all  recoverable,  plus  a  ten-year  storage  and  carrying 
cost  of  the  order  of  $60-70/bbl,  which  is  not*. 

4.  Spend  the  $100,000  on  capacity  to  make  synthetic  fuels  from  coal  or 
shale.  Using  a  reasonable — and  most  likely  conservative — whole-system  capital 
investment  of  $40,000  per  daily  barrel,  the  capacity  bought  will  have  the 
potential,  if  it  works,  to  produce  2.5  bbl/d  (about  9000  bbl/10  y)  from  about 
1990  to  2020.  By  1990,  however,  it  will  have  produced  nothing.  The  plant-gate 
price  of  its  future  output  will  probably  be  considerably  in  excess  of  $40/bbl 
[Congressional  Research  Service  1981];  the  retail  price,  perhaps  $60-90/bbl  . 

5.  Spend  the  $100,000  on  a  small  piece  of  the  proposed  Clinch  River 
Breeder  Reactor.  After  ten  years  it  will  probably  have  produced  nothing.  It 
may  thereafter  deliver  electricity  at  a  price  equivalent  to  buying  the  heat 
content  of  oil  at  upwards  of  $370/bbl  (23±/kW-h,  about  the  same  as  from  pre¬ 
sently  commercial  but  expensive — $7/Wp — solar  cells  with  a  cheap  optical  con¬ 
centrator).  The  CRBR  technology  stands  no  chance  of  conyeting  even  with  the 
costliest  conventional  alternative  (light-water  reactors)  until  well  past  the 
year  2050  [Lovins  &  Lovins  1980: 70ff;  Stockman  1977]. 

It  is  perhaps  superfluous  to  note  that  the  official  energy  policy  of  the 
United  States  has  lately  been  to  pursue  these  options  almost  exactly  in  reverse 
order,  worst  buys  firstt — worst  buys  in  terms  not  only  of  money  but  of  ability 
to  produce  an  immediate,  continuing  saving  in  oil  imports.  One  is  impelled  to 
wonder  whether  we  might  not  buy  more  resilience  by  stockpiling,  not  oil,  but 
Fiberglas®,  weatherstripping,  and  other  materials  for  weatherizing  buildings. 

6.5.  National  least-cost  scenarios. 

How  do  these  arguments  apply  to  all  forms  of  energy  throughout  the 
national  economy?  Two  detailed  1980-81  analyses  have  addressed  this  question. 

*If  world  oil  prices  rose  during  storage,  the  oil  would  appreciate;  but  the 
same  is  equally  true  of  each  barrel  saved  by  our  previous  two  options.  In 
those  cases,  one  can  consider  either  that  imported  oil  has  been  avoided  or 
that  domestic  oil  has  been  left  in  the  ground  as  a  "strategic  reserve"  with  no 
purchase  or  storage  costs. 

tThe  new  Administration,  however,  appears— wisely — to  have  reduced  its  synfuel 
goal  from  Congress' s  2  M>/d  in  1992  to  0.5  M>/d  in  1990  [DOE  1 981  a: 23 ] . 
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One,  by  Roger  Sant  and  his  colleagues  at  the  Mellon  Institute's  Energy  Produc¬ 
tivity  Center,  an  industry-supported  "think  tank"  in  Arlington,  Virginia*,  is  an 
expansion  of  Sant's  pioneering  analysis  [1979]  of  "The  Least-Cost  Energy  Stra¬ 
tegy,"  which  "minimizes  consumer  cost  through  competition."  That  1979  analysis 
showed  that  if,  for  about  a  decade  before  1978,  Americans  had  simply  bought  at 
each  opportunity  the  cheapest  means  of  providing  the  energy  services  which  they 
actually  received  in  1978,  then  in  that  year  they  would  have  bought  about  28% 
less  oil,  34%  less  coal,  and  43%  less  electricity  than  they  did  buy,  and  would 
have  paid  about  17%  less  for  their  energy  services  than  they  did  pay.  Efficien¬ 
cy  improvements  would  have  made  up  virtually  all  the  difference. 

In  1980-81,  the  same  analysts  th*'-i  used  an  even  more  detailed  model,  in 
which  many  hundreds  of  supply  aril  efficiency  options  can  compete  freely,  to 
examine  the  result  of  economically  efficient  investments  during  1980-2000.  They 
found  [Sant  etal.  1981]  that  even  ii  real  GNP  grew  by  77%,  primary  energy  use 
would  rise  by  only  11%,  and  all  t'-ve  growth  would  be  in  the  industrial  sector  as 
others  became  efficient  faster  than  their  activity  levels  grew.  Electricity 
demand  would  probably  be  stagnant  for  at  least  the  first  decade.  Efficiency 
improvements  (and  some  renewable  sources)  would  so  dominate  the  cost-effective 
choices  that  investment  in  conventional  supply  would  virtually  cease,  and  it 
would  hardly  be  worth  finishing  building  most  of  the  power  plants  now  under 
construction.  The  fraction  of  GNP  used  to  buy  energy  services  would  go  down, 
not  up,  so  that  far  from  driving  inflation,  the  energy  sector  would  become  a 
net  exporter  of  capital  to  the  rest  of  the  economy.  Imported  oil — the  costliest 
option  except  for  new  synfuel  and  power  plants — would  rapidly  dwindle  to  about 
zero,  singly  because  it  has  already  priced  itself  out  of  the  market.  It  cannot 
compete  with  efficiency  improvements  (or  with  most  renewables)  and  will  there¬ 
fore  essentially  eliminate  itself  without  special  policy  attention. 

These  conclusions  have  been  strongly  confirmed  by  a  parallel  but  indepen¬ 
dent  analysis  carried  out  by  dozens  of  consultants  coordinated  by  the  Solar 
Energy  Research  Institute  [SERI  1981]  at  the  request  of  then  Deputy  Secretary 
of  Energy  John  Sawhill.  The  SERI  draft  report  assumes  an  80%  increase  in  the 
1977  real  GNP  by  2000,  and  major  increases  in  personal  income,  comfort,  and 
mobility.  It  also  tests  efficiency  and  renewable  investments  against  alterna¬ 
tive  supply  costs  which,  while  not  as  low  as  Sant's,  are  still  well  short  of 
realistic  marginal  costs.  It  enbodies  many  technical  conservatisms,  and  as¬ 
sumes  no  technology  which  is  not  already  in  operation  in  the  United  States.  Yet 
it  shows  how  primary  energy  use  could  decrease  to  13-18%  below  the  1980  level, 
and  how,  with  economically  worthwhile  investment  in  presently  available  renew¬ 
able  sources  as  well,  the  use  of  nonrenewable  fuels  would  drop  by  nearly  half. 


*0n  1  October  1981,  this  institution  was  succeeded  by  Applied  Energy  Services, 
Inc.,  which  is  carrying  on  similar  work  for  profit  at  the  same  address. 
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At  that  level,  not  only  could  oil  imports  and  most  frontier  oil  and  gas  become 
unnecessary,  but  a  good  deal  of  conventional  lower-48  oil  and  gas  could  also  be 
shut  in  as  a  dispersed  "strategic  reserve"  with  no  extra  storage  costs. 

Total  demand  for  electricity,  too,  would  probably  decline.  With  cost-ef¬ 
fective  efficiency  improvements  and  onsite  solar  heating  systems,  the  electri¬ 
cal  growth  rate  during  1978-2000  would  be  about  0.2%/y.  With  cost-effective 
wind,  industrial  cogeneration,  and  onsite  photovoltaic  investments  added,  the 
"growth"  rate  would  become  zero  to  minus  1.4%/y.  Under  the  former  assumption 
(no  wind,  cogeneration,  or  photovoltaics) ,  national  electric  supply  would  be 
ample  even  if  no  new  plants  were  commissioned  after  1985  and  if  all  oil-fired, 
gas-  fired,  and  old  power  plants  had  been  retired  by  2000.  Under  the  latter 
assumption  (all  cost-effect ive  renewable  and  cogeneration  investments) ,  supply 
would  exceed  demand  by  about  a  third — more  than  a  sufficient  margin  to  phase 
out  all  nuclear  plants  as  well  if  desired  and  still  have  capacity  to  spare. 

Thus  the  U.S.  could  enter  the  twenty-first  century  with  a  greatly  expanded 
economy,  zero  use  of  oil,  gas,  and  uranium  in  power  plants,  total  consumption 
of  fossil  fuels  reduced  from  about  70  q/y  in  1980  to  about  40-50  q/y  in  2000, 
zero  oil  and  gas  imports,  and  ample  domestic  oil  and  gas  in  conventional, 
accessible  sites  to  last  for  some  further  decades  of  transition  to  sustainable 
sources — and  could  accomplish  all  this  simply  by  using  energy  in  a  way  that 
saves  money.  Nor  is  this  a  peculiarly  American  result.  Similar  studies,  some 
in  even  greater  detail,  have  shown  comparable  or  larger  savings  for  a  wide 
range  of  other  industrial  countries,  many  of  which  are  already  more  energy-ef¬ 
ficient  than  the  U.S.  These  analyses,  which  we  have  reviewed  elsewhere  [Lovins 
et  al .  1981],  show  that  probably  all  countries  can  cost-effectively  improve 
their  energy  efficiency  by  severalfold — a  fact  of  considerable  importance  for 
the  long-term  balance  of  world  oil  supply  and  demand.  It  is  especially  encour¬ 
aging  that  this  could  be  achieved  simply  by  permitting  market  forces  to  achieve 
the  optimal  economic  balance  between  investments  in  efficiency  and  in  new  sup¬ 
ply.  A  vulnerability-minimizing,  oil-saving  strategy  is  also  a  least-cost 
strategy.  It  is  not  inimical  to  national  strength,  security,  and  prosperity, 
but  is  the  very  means  of  obtaining  them. 

We  have  not  considered  here  the  many  other  advantages  of  such  a  policy:  in 
reducing  price  volatility  and  price  increases,  in  countering  inflation  and 
unemployment,  in  reducing  environmental  and  social  impacts,  in  moderating  ten¬ 
sions  and  inequities,  and  in  alleviating  the  global  risks  of  climatic  change 
[  id . ]  and  nuclear  proliferation  [Lovins  &  Lovins  1980].  All  these  effects  are 
important.  But  they,  and  energy  vulnerability  itself,  need  not  be  considered  at 
all  in  order  to  conclude  that  greatly  improved  energy  efficiency  should  be  a 
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dominant  national  priority  on  economic  grounds  alone.  Since  this  study  is  con¬ 
cerned  with  energy  vulnerability  and  resilience,  not  with  energy  policy  gener¬ 
ally,  we  shall  not  consider  here,  as  we  have  done  elsewhere  [ id. :9I  — 125] ,  the 
policy  instruments  by  which  such  a  result  can  best  be  achieved.  Although  our 
own  preference  is  for  a  conbination  of  truthful  prices  (with  subsidies  and 
other  distortions  removed)  and  of  purging  the  market  imperfections  which  inhib¬ 
it  efficient  response  to  price  signals,  a  more  detailed  consideration  of  how 
best  to  achieve  the  ends  we  have  described  is  more  in  the  realm  of  political 
philosophy  than  of  our  assigned  subject.  We  therefore  turn  instead  to  the 
other  half  of  an  inherently  resilient  energy  system:  the  widespread  use  of 
renewable  energy  sources  matched  in  scale  and  quality  to  their  task,  the  so- 
called  "soft  technologies"  [Lovins  1977b ,19781*.  But  while  considering  these 
sources,  we  mist  not  succunb  to  the  "gadget-on-the-roof "  syndrome  and  lose 
sight  of  the  cornerstone  of  any  resilient  energy  system:  highly  efficient 
energy  end-use.  The  benefits  of  that  efficiency  are  as  broad  and  indispensible 
as  Lao-tse  summarized  them  two  and  a  half  millenia  ago  in  Tao  Te  Ching  59: 

In  managing  affairs  there  is  no  better  advice  than  to  be  sparing. 

To  be  sparing  is  to  forestall. 

To  forestall  is  to  be  prepared  and  strengthened. 

To  be  prepared  and  strengthened  is  to  be  ever  successful. 

To  be  ever  successful  is  to  have  infinite  capacity. 


♦Sweden's  energy  R&D  budget  has  reflected  both  priorities  since  1978.  The 
1981-84  proposal  [Energy  R&D  Commission  1980]  comprises  36%  efficiency  (over 
half  of  it  in  buildings) ,  40%  renewables,  3%  district  heating,  and  7%  miscel¬ 
laneous  (system  studies,  basic  research,  and  overheads).  The  balance, 14%,  is 
for  nonrenewables — chiefly  prior  commitments  in  fusion  and  in  fission  safety 
and  waste  management,  since  over  3/4  of  Swedes  voted,  and  Parliament  enacted, 
that  Sweden  will  phase  out  nuclear  power  by  2010. 
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7.  INHERENTLY  RESILIENT  ENERGY  SUPPLIES 


Our  analysis  of  efficiency  improvements  in  the  preceding  Chapter  concluded 
that  they  are  being  implemented  at  an  astonishing  rate  (Chapter  5.3)  because 
they  are  the  cheapest  way  to  provide  energy  services.  This  trend  should  be 
encouraged  in  national  policy,  not  only  to  save  money,  but  because  more  effi¬ 
cient  energy  use  greatly  increases  individual  and  national  security.  This 
Chapter  will  first  build  on  that  conclusion  by  arguing  that  when  used  in  con¬ 
junction  with  greatly  increased  energy  efficiency,  there  is  a  particular  form 
of  energy  supply — appropriate  renewable  energy  sources — that  offers  similar 
security  benefits.  We  shall  then  compare  these  sources  in  other  respects  with 
the  technologies  which  dominate  present  Federal  energy  policy.  To  give  at 
least  a  glimpse  of  the  complexities  and  pitfalls  of  economic  comparisons*  be¬ 
tween  renewable  and  non-renewable  energy  systems,  we  shall  survey  some  generic 
features  of  those  systems'  internal  and  external  costs,  and  call  attention  to 
issues  that  arise  when  renewable  sources  are  integrated  into  existing,  mainly 
non-renewable,  energy  systems.  With  that  foundation,  we  shall  then  briefly 
assess  the  technical  and  economic  status  of  renewables,  with  special  attention 
to  some  rapidly  emerging  technologies  which  hold  special  promise  for  increasing 
energy  preparedness. 

7.1.  The  resilience  of  appropriate  renewable  sources. 

In  Chapter  6  we  compared  two  types  of  houses:  a  normal,  thermally  ineffi¬ 
cient  house  which  rapidly  reaches  uncomfortable,  even  intolerable,  temperatures 
unless  continuously  supplied  with  space-conditioning  energy  at  large  average 
and  peak  rates;  and  a  super  insulated  house  which  maintains  tolerable  tempera¬ 
tures  with  no  outside  energy  whatever,  and  comfortable  temperatures  with  vir¬ 
tually  any  small  source — especially  a  simple  renewable  source.  We  showed  that 
the  latter  type  of  house  is  cheaper,  makes  its  occupants  virtually  invulnerable 
to  interruptions  in  their  supply  of  space-conditioning  energy,  and  enables  them 
to  meet  their  space-conditioning  (and  other)  household  energy  needs  with  much 
smaller,  simpler,  and  cheaper  renewable  sources  than  they  could  have  done  in 


*More  fundamentally,  any  attempt  at  rigorous  calculation  and  comparison  of 
the  costs,  risks,  and  benefits  of  any  energy  technology  is  bound  to  run  up 
against  a  host  of  serious  theoretical  and  practical  obstacles,  which  are 
beyond  the  scope  of  this  study  but  have  been  surveyed  elsewhere  [Lovins  1977; 
Junger  1976;  Council  for  Science  &  Society  1979). 
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the  inefficient  house.  Thus  we  demonstrated  a  synergism  between  efficiency  and 
renewables,  and  a  correlation  between  favorable  economics  and  resilience. 

The  entire  national  energy  system  today  is  like  the  inefficient  house — 
dependent  for  survival  on  continuous  supplies  of  costly  and  vulnerable  energy. 
It  can  and  should  be  made  like  the  superinsulated  house — cheaper,  less  depen¬ 
dent,  more  resilient.  If  this  is  not  done,  no  kind  of  energy  supply  can  long 
sustain  the  American  economy,  and  the  marginal  supplies  required  even  in  the 
short  term  are  so  precarious  as  to  pose  a  grave  threat  to  national  security. 

Federal  energy  policy  has  long  assumed ,  as  was  widely  believed  a  decade 
ago,  that  efficiency  gains  can  only  be  small  (perhaps  10-20%).  If  this  were 

true,  the  U.S.  would  need  far  more  energy  in  the  future,  and  would  have  to  get 

much  of  it  by  expanding  the  same  kinds  of  inherently  vulnerable  energy  systems 
which  are  of  such  security  concern  today.  There  would  be  no  alternative  to 
"Strength  Through  Exhaustion"  (of  domestic  resources).  A  future  of  "The  Past 
Writ  Large"  would  mean  ever  greater  vulnerability,  with  no  respite  in  sight. 

Analysts  who  hold  this  view  do  not  readily  appreciate  the  profound  struc¬ 
tural  changes  which  cost-effective  levels  of  energy  efficiency  can  bring.  The 

SERI  analysis  [1981],  for  example,  showed  how  the  U.S.  can  achieve  strong  eco¬ 
nomic  growth  over  the  next  twenty  years  with — indeed,  — investing  far  more 

heavily  in  energy  productivity,  so  as  to  achieve  a  proper  balance  with  energy 
supply  investments.  If  this  were  done,  as  we  showed  in  Chapter  6,  the  most 
vulnerable  sources  (imported  oil,  LNG,  frontier  oil  and  gas,  nuclear  power) 
could  be  phased  out  entirely,  and  dependence  on  other  vulnerable  systems  (cen¬ 
tral  power  stations  and  their  grids,  oil  and  gas(pipel ines ,  Western  coal)  could 
be  greatly  reduced.  But  a  result  of  even  greater  importance  is  that  far  more 
resilient  renewable  sources  could  cost-ef fe%t ively  supply  up  to  33%  of  total 
national  energy  needs  in  2000 — and  approximately  100%  within  a  few  decades 
thereafter  [Sorensen  1980;  Lovins  et  al .  1981],  Sustainable  sources,  not 
exhaustion,  would  then  underpin  long-term  prosperity  and  security. 

Thus  greater  energy  efficiency  has  the  security  advantage  that  it  will 
rapidly  eliminate  the  most  costly  and  vulnerable  energy  systems.  The  remaining 
demand  will  then  be  so  small  (a  quarter  less  in  2000  than  today,  and  declining 
thereafter)  that  insecure  and  dwindling  fi^ls  can  be  most  cheaply  and  easily 
replaced  by  almost  invulnerable  renewable  sources — sources  which,  as  we  shall 
show  below,  are  the  cheapest  long-run  sources  available  after  efficiency  gains. 
Far  from  being  minor,  unimportant  sources,  the  many  kinds  of  appropriate  renew¬ 
able  technologies  would  make  a  major  and  soon  a  dominant  energy  contribution. 
Thus  a  major  structural  change  in  energy  supply  would  become  both  possible  and 
economically  preferable — completing  the  transformation  of  the  American  energy 


204 


system  from  living  on  energy  capital  to  living  on  energy  income,  and  from 
vulnerability  to  resilience. 

By  "appropriate”  renewable  sources  —  "soft  technologies"  for  short — we  mean 
those  which  supply  energy  at  the  scale  and  in  the  qual i ty  which  will  provide 
each  desired  energy  service  at  least  cost  to  the  consumer.  Chapter  5  showed  how 
a  mismatch  of  scale  between  source  and  use  can  roughly  double  energy  service 
costs  by  incurring  the  costs  and  losses  of  a  vast  distribution  network.  Proper 
scale  for  each  task  can  minimize  those  costs  and  losses.  Likewise,  Appendix  A 
describes  how  supplying  energy  of  the  right  form  for  each  task  can  minimize  the 
costs  and  losses  of  energy  conversion.  Thus  the  92%  of  U.S.  delivered  energy 
which  is  needed  in  the  form  of  heat,  or  as  a  portable  fuel  for  vehicles,  is 
most  economically  supplied  in  those  forms — not  as  electricity,  which  is  cost- 
effective  only  for  a  premium  8%  of  all  delivered  energy  needs.  This  is  because 
electricity  is  conventionally  generated  in  costly,  complex  machines  which  lose 
two-thirds  of  the  energy  in  the  fuel  in  order  to  make  a  high-quality  energy 
form.  If  that  quality  is  not  used  to  advantage — if,  for  example,  the  electri¬ 
city  is  used  for  space-conditioning — then  the  whole  conversion  process  was  a 
waste  of  money  and  fuel.  Most  "appropriate"  sources  are  thus  non-electrical. 

Renewable  sources  are  often  described  as  "new,"  "unconventional,"  or 
"exotic."  None  of  these  labels  is  accurate.  To  be  sure,  many  renewable  energy 
technologies  have  been  greatly  improved  by  modern  materials  and  design  science. 
But  this  is  only  the  latest  stage  in  an  evolutionary  process  stretching  back 
for  hundreds,  even  thousands,  of  years  [Butti  &  Perlin  1980).  Such  technolo¬ 
gies  as  passive  solar  design,  windpower,  and  biomass  alcohols  were  well-known 
in  rather  sophisticated  forms  millenia  ago.  Solar  concentrators  were  used  in 
the  Battle  of  Syracuse  (the  only  significant  known  military  use  of  solar  tech¬ 
nology).  Flat-plate  collectors  are  two  centuries  old;  photovol ta i cs  and  solar 
heat  engines,  over  a  century.  Repeatedly,  many  solar  technologies  have  become 
respectably  mature  only  to  be  cut  off  by  the  discovery  of  apparently  cheap 
deposits  of  fuels,  whether  wood  in  the  Roman  Empire,  coal  in  industrializing 
Britain,  or  oil  in  our  own  time.  Each  time,  as  scarcity  and  a  sense  of  inse¬ 
curity  returned,  the  renewable  sources  have  been  reinvented.  The  latest  re- 
emergence  may  be  the  last  time  it  is  necessary  to  repeat  this  process. 

The  most  obvious  feature  of  renewable  energy  sources  is  that  they  harness, 
not  a  deposit  of  fossil  or  nuclear  fuel  that  is  very  unevenly  distributed  in 
the  earth's  crust,  but  a  variety  of  direct  and  indirect  fluxes  of  solar  energy* 

*We  do  not  consider  here  geothermal  energy  or  tidal  power  ( moon power ) ,  since 
neither  is  renewable  in  principle.  In  the  right  sites  and  with  due  attention 
to  their  considerable  potential  for  environmental  damage,  however,  both  can  be 
locally  important  for  providing  heat  and  electricity  respectively. 
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which  are  distributed  freely,  equitably,  and  daily  over  the  entire  surface  of 
the  earth,  and  are  not  subject  to  embargoes,  strikes,  or  other  major  interfer¬ 
ence.  "Equitably"  does  not  mean  equally.  The  flux  of  solar  energy  fluctuates 
in  time  and  space,  both  according  to  the  predictable  pattern  of  the  earth's 
rotation  and  orbit  and  according  to  the  variations  of  weather,  which  tend  to  be 
more  stochastic  (random  in  detail  but  statistically  predictable  in  general 
pattern).  These  variations,  however,  are  quite  well  understood  [Sorensen 
1979],  and  a  properly  designed  renewable  energy  system  can  readily  cope  with 
them — given  efficient  energy  use--by  using  the  combination  of  sources  and  de¬ 
sign  parameters  suitable  to  each  site  and  application.  Sources  can  be  chosen 
which  tend  to  work  best  in  different  weather  patterns,  i.e.  which  have  nega¬ 
tively  correlated  output:  cloudy  weather,  bad  for  solar  cells,  is  often  good 
for  windpower,  and  droughts,  bad  for  hydro,  are  good  for  solar  cells.  Existing 
storage,  like  water  behind  hydro  dams,  or  on-site  storage  can  be  provided.  End- 
use  devices  can  be  designed  with  long  time  constants  to  cope  with  intermit- 
tence.  Solar  energy  can  be  harvested  and  converted  from  vegetation  at  one's 
convenience  rather  than  captured  instantaneously  as  direct  solar  radiation. 
Sources  can  be  integrated  over  a  sufficient  area  to  average  out  fluctuations  in 
the  renewable  energy  flux  or  in  end-use  patterns. 

The  intermi t tence  of  renewable  energy  fluxes  is  smaller  than  one  might 
imagine.  A  typical  wind  machine  in  Denmark  needs  only  ten  hours'  storage  to  be 
as  reliable  as  a  typical  light-water  reactor  [  J_d^.  :  582  f  ]  .  The  statistical  com¬ 
plementarity  of  wind,  hydro,  and  solar  cells  (photovoltaics) ,  especially  if 
dispersed  over  a  sizeable  area  [Kahn  1979 : 3 19  f  ]  ,  can  make  a  grid  combini:'.;  ;*,em 
more  reliable  than  one  using  fossil-  or  nucleai — fueled  steam  plants.  Such 
results  often  surprise  designers  of  today's  "hard  technologies."  But  they  need 
to  appreciate  better  the  unreliability  of  their  own  systems.  In  principle  the 
need  to  design  for  fluctuation  is  nothing  new.  Today's  energy  systems  fluctu¬ 
ate  too,  far  less  predictably,  whenever  there  is  an  oil  embargo,  coal  strike, 
etc.,  and  this  kind  of  fluctuation  must  also  be  guarded  against  by  design. 
Failure  to  do  this  adequately — to  consider  the  impact  of  surprises,  failures, 
and  deliberate  disruptions — has  indeed  helped  to  make  today's  energy  system  as 
vulnerable  as  it  is.  Fluctuations  in  renewable  energy  fluxes  are  in  this  sense 
better  understood  and  more  predictable  than  those  in  the  supply  of  conventional 
fuels  and  power*.  The  calculations  that  go  into  writing  a  weather  forecast 

*They  also  tend  to  be  less  severe.  Kahn  [1978:33],  for  example,  notes  that 
in  a  Pacific  Coast  wind  array,  "a  lull... which  reduced  power  to  about  1/3  the 
summer  mean  would  last  for  15  hours  with  95%  probability.  For  99%  availabil- 

ability  of  [at  least]... 1/6  the  summer  mean,  the  luli  would  last  about  10 
hours.  For  comparison,  however,  major  outages  of  LWR  generators  have  an  aver¬ 
age  duration  of  300  hours  [at  zero  output)." 
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or  an  ephemeris  of  the  motions  of  the  sun  are  considerably  more  reliable  than 
those  that  predict  reactor  accidents  or  Saudi  politics.  One  can  have  greater 
confidence  that  the  sun  will  rise  tomorrow  than  that  someone  will  not  blow  up  a 
supertanker  in  the  Straits  of  Hormuz.  It  can  be  cloudy  for  days  or  weeks  (not, 
as  noted  below,  a  serious  impediment  to  solar  systems  designed  for  cloud),  but 
the  sun  cannot  be  totally  eclipsed  for  months  like  an  oil-import  cutoff. 

We  have  been  careful  to  state  that  appropriate  renewable  sources-not  all 
renewable  sources — offer  economic  and  security  advantages.  Unfortunately,  the 
overwhelming  emphasis  in  Federal  renewable  programs  so  far  has  been  on  the 
least  economic  and  least  resilient  renewables,  especially  the  central-electric 
ones.  The  historic  reasons  for  this  tendency  to  "make  solar  after  the  nuclear 
model,"  as  two  veteran  observers  remarked  [Hammond  &  Metz  1977],  are  rooted  not 
in  economic  rationality  but  in  mere  force  of  habit.  The  R&D  managers  assumed 
the  desired  product  was  baseload  electricity,  even  though  the  8%  of  delivered 
energy  needs  that  can  give  us  our  money's  worth  from  electricity — a  special  and 
very  expensive  form  of  energy — are  already  met  twice  over  by  power  stations 
already  in  operation.  Federal  energy  agencies  and  their  major  contractors  also 
assumed,  all  but  universally,  that  the  way  to  develop  renewable  sources  was  to 
build  prototypes — first  of  megawatt  scale,  then  working  up  in  stages  to  giga¬ 
watt  scale — just  as  if  the  product  were  a  new  kind  of  fission  reactor.  They 
apparently  assumed  that  anything  else,  or  anyth. ng  designed  for  a  market  other 
than  utilities,  "would  fall  short  of  a  major  contribution"  [_i_d.].  Believing 
solar  contributions  would  be  small  and  far  in  the  future,  they  sought  to  carry 
out  their  self-fulfilling  prophecy  by  emphasizing  the  least  economic  designs. 

Thus  considerable  engineering  talent,  and  contracts  probably  amounting  to 
tens  of  millions  of  dollars,  have  been  devoted  to  conceptual  designs  for  solar 
power  satellites,  even  though  the  cheap,  efficient  solar  cells  which  they  pre¬ 
suppose  would  deliver  far  cheaper  electricity  [Foreman  1981]  If  put  on  roofs  in 
Seattle.  In  that  form  they  would  be  virtually  invulnerable,  whereas  in  orbit 
they  could  (as  Hermann  Oberth  pointed  out  a  half-century  ago)  be  turned  into 
Swiss  cheese  by  anyone  who  cared  to  buy  a  weather  rocket  and  launch  a  load  of 
birdshot  into  the  same  orbit  in  the  opposite  direction,  there  to  meet  the  vast 
collector  areas  of  the  satellite  every  half-hour  at  36,000  miles  per  hour. 

Likewise,  DOE  has  spent  most  of  its  wind  budget  on  developing  multi-MWe 
machines  with  blades  like  a  747  wing.  They  are  enormous,  complex,  prone  to 
high-technology  failures,  and  useful  only  to  large  utilities.  Each  unit  costs 
millions  of  dollars  and  is  made,  rather  like  a  jetliner,  by  a  highly  special¬ 
ized  aerospace  firm,  then  shipped  across  the  country  to  the  site.  In  contrast, 
some  U.S.  manufacturers  have  independently  developed  wind  machines  in  the  kWe 
or  tens-of-kWe  range  which  have  simple  bolt-on  sheet-metal  blades,  no  brushes, 
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one  bearing,  two  or  three  moving  parts,  and  essentially  no  maintenance  require¬ 
ments  (p.  176).  Any  handy  person  can  make  and  use  them.  They  are  available  now 
4^246) at  lower  costs  per  kWe  than  DOE  estimates  its  designs  will  drop  down  to. 

An  anecdote  reveals  the  philosophical  divergence.  After  spending  tens  of 
thousands  of  dollars  on  computerized  electronic  sensors  to  shut  down  a  DOE  wind 
machine  if  it  started  to  vibrate  too  much,  its  designers  visited  the  200-kWe 
Gedser  machine  operated  decades  ago  in  Denmark.  Its  vibration  sensor  was  a 
saucer  containing  a  large  steel  ball.  If  the  tower  shook  too  much,  the  ball 
would  slop  out  of  the  saucer  and  fall  down,  and  a  string  attached  to  it  would 
pull  a  switch.  (There  is  a  postscript:  the  DOE  sensors  proved  unreliable,  and 
had  to  be  supplemented  by  a  closed-circuit  TV  camera  monitoring  a  painted  film 
can  hung  from  a  string  so  the  operators  could  see  when  the  tower  shook.) 

There  is  thus  a  considerable  difference  between  the  renewable  sources  on 
which  most  Federal  attention  has  been  focused  and  those  sources  which  merit  it 
by  their  economic  and  security  benefits.  This  difference  is  partly  in  unit 
scale  and  simplicity.  It  is  partly  in  the  types  of  technologies  considered: 
we  have  not,  for  example,  found  an  instance  where  central-receiver  solar-ther¬ 
mal-electric  systems,  or  ocean-thermal-electric  conversion  (OTEC) ,  or  solar 
power  satellites,  or  monocultural  biomass  energy  plantations,  look  economic  or 
necessary.  And  the  difference  is  also  partly  institutional  and  psychological. 
DOE  has  tended  to  favor  "inaccessible"  technologies  which  reinforce  the  suppo¬ 
sition  that  ordinary  people  should  be  mere  passive  clients  of  remote  technocra¬ 
cies.  This  in  turn  encourages  people  to  think  that  if  energy  supplies  are  dis¬ 
rupted,  "the  Government"  will  take  care  of  it.  We  believe  it  is  important,  if 
energy  preparedness  is  to  become  a  reality,  that  people  feel  empowered  to  use 
their  own  skills,  solve  their  own  problems,  and  largely  look  after  themselves. 
This  requires  in  turn  that  they  have,  and  know  that  they  have,  most  of  the 
technological  means  to  do  so. 

We  premise  this  Chapter,  then,  on  the  assumption  of  intelligent  design 
based  on  sound  economic  principles,  not  on  mere  habit.  Given  such  good  design, 
renewable  energy  systems  can  systematically  fulfil  their  outward  promise  of  be¬ 
ing  difficult  to  disrupt.  Consider,  for  example,  how  soft  technologies  can  avoid 
most  or  all  of  the  twelve  sources  of  vulnerability  identified  in  Chapter  2.1. 
They  are  unlikely  to  bring  the  user  into  contact  with  dangerous  materials  (ex¬ 
plosive  or  radioactive);  even  renewable  liquid  fuels  (alcohols  and  pyrolysates) 
tend  to  be  much  less  hazardous,  in  flammability  and  toxicity,  than  their  petro¬ 
leum-based  counterparts.  (A  possible  exception  is  that  certain  types  of  solar 
cells  can  be  made  with  small  amounts  of  cadmium,  arsenic,  or  other  highly  toxic 
materials,  and  the  burning  of  a  cell-bearing  house  could  release  these  to  the 


208 


environment  in  quantities  of  tens  or  hundreds  of  grams.  Highly  efficient  cells 
can  also  be  made,  however,  at  similar  or  lower  cost  from  other  materials  which 
are  either  nontoxic  or  refractory.)  Far  from  having  limited  public  acceptance, 
appropriate  renewable  sources  enjoy  a  90+%  complete  consensus  unmatched  bv  any 
other  category  of  energy  technologies  [Farhar  etal.  1980;  Milstein  1978j.  With 
the  exception  of  existing  large  hyd roe lect r i c  dams  appropriate  for  the  few  con¬ 
centrated  end-uses  of  electricity,  such  as  smelters,  sensibly  designed  renewa¬ 
ble  sources  avoid  centralization  of  supplies.  Because  they  collect  renewable 
energy  flows  where  they  are,  rather  than  mining  a  fuel  elsewhere  and  transport¬ 
ing  it,  they  do  not  suffer  from  long  haul  distances.  Their  usual  range  is  from 
inches  or  feet  (in  buildings)  to  miles  or  perhaps  tens  of  miles  in  some  biocon¬ 
version  systems.  Limited  substitutability  is  seldom  characteristic  of  renewable 
sources:  many  bioconversion  systems,  for  example,  can  cope  with  an  immense 
range  of  feedstocks  within  broad  limits  of  wetness  and  carbon/nitrogen  ratio, 
and  some,  like  the  thermochemical  processes  (p.244),  can  make  the  same  widely 
usable  tiquid  or  gaseous  fuels  from  any  cellulosic  or  woody  feedstock  regard¬ 
less  of  origin.  Likewise,  efficient  solar  collectors  can  be  made  out  of  a  vast 
range  of  materials — glass  or  plastic  or  recycled  storm-doors  for  glazing,  steel 
or  aluminum  or  wood  or  paper  or  plastic  film  (or  even  beer  cans)  for  absorbers, 
rocks  or  masonry  or  water-filled  oil  drums  or  recycled  bottles  for  heat  stor¬ 
age,  or  even  a  hole  in  the  ground  and  some  brine — a  solar  pond — in  lieu  of  all 
these  components  (p.241).  The  range  is  limited  mainly  by  one's  imagination. 

Unlike  large  turbogenerators,  renewable  sources  of  electricity  are  diffi¬ 
cult  to  damage  if  synchronization  breaks  down.  A  solid-state  grid- interface 
device  can  enable  them  to  cope  with  unusual  or  rapidly  changing  electrical  con¬ 
ditions  which  normal  electromechanical  devices  could  not  handle  (p.226).  Renew¬ 
able  sources  integrated  into  a  grid  require  sync hr on izat i on ,  but  with  proper 
design  they  can  also,  unlike  other  sources,  work  as  well  into  a  local  load 
without  synchronization,  in  isolation  from  the  grid,  or  even  on  direct  current. 
The  tendency  of  properly  designed  renewable  sources  to  distribute  energy  in  the 
final  forms  in  which  it  will  be  used,  such  as  heat  or  unspecialized  vehicular 
fuels,  eliminates  many  of  the  inflexible  delivery  systems  that  make  their 
nonrenewable  counterparts  so  logistically  complex.  The  cheapest  and  most 
effective  renewable  designs  also  tend  to  avoid  interactions  between  energy 
systems — whether  by  substituting  convective  circulation  for  active  pumping  in  a 
thermal  system  or  by  using  wind  stirring  or  solar  process  heat  in  bioconver- 
s i on .  Although  many  soft  technologies  have  modestly  high  capital  intensity, 
theirs  is  considerably  lower  (as  we  shall  show  below)  than  their  competitors', 
and  they  have  an  even  greater  advantage  in  avoiding  long  lead  times  and 
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specialized  labor  and  control  requirements.  Their  distribution  systems,  too, 
are  seldom  large  enough  to  make  distribution  of  noxious  materials  a  significant 
concern.  While  all  these  agreeable  properties  are  not  a  necessary  part  of  a 
renewable  energy  system,  they  will  generally  result  from  design  for  least  cost. 

Properly  arranged  soft  technologies  also  satisfy  most  or  all  of  the  prin¬ 
ciples  of  resilient  design  (Chapter  4.4).  They  are  mainly  dispersed  to  match 
their  uses  (Chapter  5.1).  Their  large  numbers,  diversity,  and  overlapping  end- 
use  functions  can  offer  both  numerical  and  functional  redundancy — as  in  a  town 
whose  blend  of  a  large  number  of  different  sources  of  electricity  (wind,  micro¬ 
hydro,  solar  cells,  solar  ponds  with  heat  pngines,  etc.)  or  of  biomass  liquid 
fuels  offers  built-in  backup  in  case  particular  dpvices  or  types  of  devices 
have  trouble.  Electricity-generating  soft  technologies  can  readily  be  inter¬ 
connected^  whi le  maintaining  node  autonomy — the  ability  to  stand  alone  at  need 
(Chapter  7.2.3).  They  provide  far  greater  functional  flexibility  in  adapting 
to  changes  in  operating  conditions  and  feedstocks  than  virtually  any  "hard 
technology"  could  tolerate.  Their  design  can  readily  incorporate — and  often 
will  for  economic  reasons — modularity  and  standardization,  as  in  mass  produc¬ 
tion  of  solar  cells  or  site-assembly  of  mass-produced  collector  components,  al¬ 
though  the  diversity  of  people  and  institutions  pursuing  them  will  help  to  pre¬ 
vent  a  degree  of  standardization  that  might  serve  to  propagate  design  errors. 
That  safeguard  is  reinforced  by  a  speed  of  evolution  that  has  compressed  gener¬ 
ations  of  technical  development  into  a  few  years.  Being  made  of  relatively 
cheap  and  simple  materials  and  using  relatively  undemanding  processes,  soft 
technologies  can  readily  incorporate  internal  decoupling  and  buffering  without 
unreasonable  extra  cost.  Their  simpl ic i ty  and  forg ivingness  ,  their  accessibil¬ 
ity  to  and  re prod uc ibil ity  by  a  wide  range  of  actors,  and  their  social  compati¬ 
bility  are  among  their  main  hallmarks.  There  is  hardly  a  quality  conducive  to 
resilience  which  they  do  not  have  in  abundance;  hardly  one  conducive  to 
brittleness  and  vulnerability  which,  with  proper  design,  they  cannot  avoid. 

These  resilient  characteristics,  however,  are  not  a  sufficient  basis  for 
choice.  Indeed,  our  discussion  of  efficiency  improvements  in  Chapter  6  ignored 
their  security  benefits  and  considered  only  their  economics.  To  be  equally 
conservative',  we  should  take  a  similar  course  here.  We  therefore  consider  next 
some  generic  problems  of  comparing  energy  technologies,  as  a  prelude  to 
surveying  the  state  of  the  art  in  appropriate  renewable  sources. 

7.2,  Assessing  soft  technologies:  generic  issues. 

Calculating  the  economics  of  renewable  compared  to  nonrpnowablo  energy 
sources  (or  renewables  vs.  each  other  or  vs.  efficiency  improvements)  is  easy 
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to  describe  but  very  difficult  to  do  properly.  In  principle,  the  economic 
value  of  renewables  depends  both  on  the  price  of  the  energy  they  deliver  and  on 
the  price  of  the  energy  they  replace.  Both  are  highly  uncertain.  Both  can  be 
evaluated  only  with  reference  to  a  particular  energy  service  delivered  to  a 
final  user.  Market  price  reflects  some  "internal"  costs  but  excludes  others 
("externalities"),  such  as  unregulated  forms  of  pollution,  vulnerability,  or 
other  costs  paid  by  neighbors  or  by  society  as  a  whole,  not  specifically  by  the 
buyer.  We  therefore  consider  internal  and  external  costs  separately. 

7.2.1.  Internal  costs. 

Renewable  energy  systems  have  no  fuel  cost  (except  for  the  feedstock  to 
bioconversion  systems  and,  perhaps,  water  rights  for  some  hydro).  If  well 
designed  and  built,  they  also  tend  to  have  low  operating  and  maintenance  costs. 
(If  not,  long-term  economic  performance  can  be  quite  sensitive  to  those  costs.) 
The  price  of  renewable  energy  therefore  depends  mainly  on: 

1.  Their  initial  capital  cost.  This  depends  strongly  on 

a.  The  simplicity,  cleverness,  and  durability  of  design.  These  can 
vary  enormously  and  may  bear  no  relation  to  the  designer's  formal 
credentials:  indeed,  highly  qualified  designers  may  produce  the 
most  gratuitously  complex  designs. 

b.  The  marketing  structure.  A  "packaged"  flat-plate  solar  collector 
system  with  three  or  four  markups  can  cost  several  times  as  much 
as  an  otherwise  identical  "site-assembled"  system  with  one  markup 
[Worcester  Poly.  1978;  Godolphin  1981]. 

c.  How  efficiently  the  delivered  energy  is  used.  This  affects,  as  we 
noted  in  the  Saskatchewan  Conservation  House  example,  the  size  of 
the  renewable  system  (which  can  be  altered  by  tenfold),  its  per¬ 
formance,  and  its  complexity  (as  in  the  replacement  of  a  heat-dis¬ 
tribution  system  by  natural  convection).  Such  synergisms  can  be 
examined  only  on  a  micro  design  level. 

These  effects  can  together  change  unit  prices  by  factors  ranging  from 

ten  to  perhaps  a  thousand. 

2.  The  cost  of  financing  them  over  their  lifetimes.  This  depends  on 

a.  Real  interest  rates,  which  depend  on  perceived  risk  and  should 
therefore  be  lower  for  many  renewables  [Kahn  et  a  1  .  1980). 

b.  Working  capital  requirements.  These  are  related  to  capital  inten¬ 
sity  by  construction  time,  payback  time,  and  shape  of  cash-flow, 
and  again  should  be  more  favorable  for  soft  technologies  [id.[. 
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c.  Projected  operating  lifetime,  which  may  be  difficult  to  estimate. 
(Some  wind  machines  and  flat-plate  solar  collectors  have  worked 
well  for  decades  with  little  or  no  maintenance.  Badly  built,  they 
could  have  failed  in  a  few  months  or  years.  Some  designs  are  much 
more  forgiving  of  mistakes  and  environmental  insults  than  others.) 

3.  The  amount  of  energy  supplied  annually.  This  depends  on 

a.  Quality  of  design,  construction,  operation,  and  maintenance. 

b.  Patterns  of  energy  use.  A  mismatch  between  supply  and  demand 
patterns  could  leave  some  demand  unmet  or  lead  to  the  "dumping"  of 
surplus  supply  (such  as  unneeded  space  heat  in  the  summer). 

c.  Variations  in  weather  and  climate. 

d.  Appropriateness  of  design  to  local  conditions  and  use  patterns. 
Some  large  corporations  have  been  unable  to  compete  in  the  solar- 
collector  market  with  some  small  businesses,  not  only  because  the 
latter  had  better  innovation  and  lower  overheads,  but  also  because 
they  could  achieve  better  performance  by  matching  designs  to  local 
weather,  building  styles,  etc. — rather  than  making  a  "cookie- 
cutter"  product  which  is  designed  for  a  hypothetical  average  case 
and  is  therefore  suboptimized  for  any  actual  particular  case. 

4.  The  amount  and  type  of  storage  required,  if  any.  This  depends  on  the 
three  factors  just  listed  and  on  the  nature  and  degree  of  integration 
with  other  renewable  or  nonrenewable  sources.  (We  shall  consider 
these  integration  issues  further  below.) 

This  may  seem,  and  it  is,  more  complex  than  one  might  have  expected.  But  to 
make  matters  worse,  the  price  of  competing  nonrenewable  energy  is  equally 
imponderable.  It  depends  mainly  on 

1.  General  and  sector-specific  inflation  in  the  cost  of  goods,  services, 
and  money,  both  during  construction  and  afterwards  for  the  project's 
operating  lifetime. 

2.  The  relationship  between  historic  and  marginal  capital  costs.  (The 
latter  have  generally  exceeded  the  former  since  about  1970.) 

3.  The  difficulty  of  obtaining  fuels  from  ever  more  remote  and  awkward 
places . 

4.  The  economic  and  political  policies  of  fuel-exporting  countries  inter¬ 
acting  with  a  complex  world  market  and  with  unforeseeable  political 
ex i gene ies . 

5.  National  and  local  policies  regarding  trade,  legal  structures,  infla¬ 
tion  control,  employment,  environment,  and  a  host  of  other  factors. 
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6.  Technical  reliability  and  resilience  desired. 

7.  Tax  and  accounting  conventions,  tariff  structures,  and  subsidies. 
Subsidies  to  the  U.S.  energy  system  total  over  $252  billion  (1978  $) 
historically  [Cone  et  a  1 .  1980],  with  the  nuclear  term  sufficing  to 
cut  the  apparent  cost  about  in  half  [Bowring  1980;  Omang  1981].  Tax 
and  price  subsidies  are  currently  continuing  at  a  rate  of  the  order  of 
$100  billion  per  year  [Lovins  1981a] — enough  to  reduce  average  energy 
price  by  over  a  third  and  nuclear  electricity  price  by  over  half  again 
[ Chapman  1979 ] . 

8.  Salvage  values.  (For  nuclear  facilities  and  wastes  these  are  negative 
but  of  unknown  size.) 

Renewable/nonrenewable  comparisons  are  further  complicated  by  the 
following  problems: 

1.  Great  variation  in  price  quotations  even  for  one  product  in  one  mar¬ 
ket.  Identical  gas-fired  water  heaters  in  identical  Southern 
California  apartments  differ  by  a  factor  of  two  in  retail  price  and  by 
nearly  a  factor  of  three  in  installed  price.  Price  scatter  is  larger 
in  solar  markets,  which  are  less  mature  and  have  more  diverse  product 
lines  and  marketing  structures. 

2.  Extremely  rapid  technical  change,  especially  for  renewables,  much  of 
it  outside  official  programs  and  traditional  information  channels. 

3.  Uncertainty  about  how  far,  or  how,  to  internalize  important  externali¬ 
ties  (many  of  which  are  considered  further  below). 

4.  What  depletion  value  to  put  on  nonrenewable  fuels  and  other  resources. 
Their  cost  was  traditionally  assumed  to  be  only  the  cost  of  mining 
them,  as  if  that  mining  did  not  make  their  future  replacement  more 
costly  to  society. 

5.  Asymmetries  in  tax  and  price  subsidies,  generally  favoring  nonrenew¬ 
ables.  Reliable  subsidy  assessments  are  very  scarce. 

6.  The  many  imponderable  (e.g.  psychological  and  political)  factors  that 
help  to  determine  how  far  and  how  fast  different  available  technolo¬ 
gies  can  be  put  into  use. 

7.  Economies  and  diseconomies  of  scale  (Chapter  5). 

8.  The  inability  of  most  simulation  models  used  by  energy  policy  analysts 
to  cope  properly  with  diverse,  relatively  dispersed  renewable  sources 
or  with  their  nont rad i t ional  processes  of  market  penetration  (Chapter 
5.3). 

9.  The  need  to  match  any  renewable  source  to  its  climate,  site,  applica¬ 
tions,  and  users,  in  order  to  achieve  best  performance  at  least  cost. 
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10.  The  difficulty  of  comparing  the  storage  and  backup  requirements  of 
complete  energy  systems  containing  renewable  or  nonrenewable  compon¬ 
ents,  to  achieve  a  given  level  of  reliability  to  final  users,  when 
there  is  not  a  fully  satisfactory  reliability  theory  for  either  type 
of  system,  let  alone  for  both  in  combination. 

11.  The  potential  for  total-en'rgy  systems  which  provide  electricity  and 
heat  (and  perhaps  liquid  fuels)  and  for  other  types  of  hybrids  (dis¬ 
cussed  below). 

12.  The  opportunities  offered  by  many  renewable  sources  (but  only  rarely 
by  nonrenewables)  for  sharing  functions  and  costs  through  integration 
into  shelter,  food,  water,  or  other  systems. 

13.  The  difficulty  of  identifying  such  integration  opportunities,  or 
indeed  many  renewable  energy  opportunities  by  themselves,  without  a 
highly  localized  and  disaggregated  analysis. 

14.  The  sensitivity  of  economic  comparisons  to  minor  changes  in  accounting 
for  inflation,  "level i zing"  varying  costs  over  the  life  of  a  project, 
discounting  the  future,  etc.  Small,  seemingly  innocuous  changes  in 
real  discount  rate  are  a  commonly  used  method  of  reversing  the  merits 
of  renewable/nonrenewable  comparisons. 

In  view  of  these  complications,  it  is  not  surprising  that  virtually  no 
renewable/nonrenewable  cost  comparison  will  prove  satisfactory  to  everyone. 
Experts  often  disagree  about  basic  data  by  factors  of  severalfold,  depending  on 
their  familiarity  with  recent  developments  and  willingness  to  accept  empirical 
data  as  "existence  proofs."  They  differ  in  their  assessment  of  the  state  of 
the  art  or  the  applicability  of  certain  methodologies.  They  do  not  accept 
other  experts'  views  on  how  far  particular  case-studies  are  more  widely  applic¬ 
able.  Thus  a  large  number  of  energy  experts,  laid  end  to  end,  will  probably 
never  reach  a  conclusion  about  the  economics  of  renewable  sources. 

The  only  recourse  is  to  make  assumptions  and  data  sources  explicit  enough 
so  that  cost  calculations  are  transparent,  scrutable,  and  easily  compared.  It 
must  also  not  be  expected  that  the  unit  cost  of  any  technology  can  be  repre¬ 
sented  by  a  single  number.  Economic  theory  indeed  requires  that  each  techno¬ 
logy  (or  aggregate  of  different  technologies)  be  subject  to  a  "supply  curve"  in 
which  unit  price  rises  with  increasing  supply.  That  this  is  the  case  for  con¬ 
ventional  utility  power-plants,  owing  to  a  complex  series  of  political-regula¬ 
tory  relationships  reflecting  a  public  desire  to  hold  constant  the  perceived 
social  cost  of  expanding  coal  and  nuclear  sectors,  is  nicely  illustrated  in  the 
following  graph.  It  plots  as  supply  curves  the  data  obtained  by  Romanoff s 

11981]  statist  ical  analysis  of  historic  costs,  which  explains  92%  of  the  ob- 
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served  variation  in  the  real  cost  per  installed  kWe  of  nuclear  plants  and  68% 
for  coal-fired  plants,  with  samples  of  46  and  116  plants  respectively. 

Plant  construction  cost  (1979  steam-plant  $  per  net  kWe  installed,  without 


Although  the  shape  of  the  supply  curve  would  probably  differ — especially 
in  being  concave  rather  than  convex  upwards — renewable  sources  too  have  supply- 
curve  costs  rather  than  point  costs.  For  example,  solar  heat  collectors  small 
enough  to  go  on  a  building  usually  cost  less  than  those  which  require  extra 
land  (usually  an  artifact  of  inefficient  energy  use).  Biomass  fuel  systems 
which  convert  special  crops — likewise  a  symptom  of  inefficient  use — incur  extra 
farming  and  collection  costs  compared  with  those  that  use  wastes  already 
harvested,  especially  where  those  wastes  are  currently  a  nuisance  and  any  new  way 
of  disposing  of  them  earns  an  economic  credit.  Most  official  analyses  of 
renewable  sources  evaluate  their  costs  on  the  high,  steeply  sloping  portions  of 
their  supply  curves  to  which  inefficient  energy  use  drives  them.  The  low, 
shallowly  sloping  portions,  however,  reflect  a  more  nearly  optimal  economic 
balance  between  investments  in  energy  supply  and  in  energy  product ivi t y,  and 
therefore  represent  the  supply  corresponding  to  the  "market  clearing  price"  at 
which  the  supply  and  demand  curves  cross  in  equilibrium.  Hence  energy  supply 
costs  cannot  be  analyzed  independently  of  competition  with  energy  productivity. 
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Despite  all  the  generic  uncertainties  of  renewable/nonrenewable  cost 
comparisons,  four  broad  principles  can  often  simplify  economic  choices: 

1.  Investment  decisions  should  be  based  not  on  projected  small  differen¬ 
ces  of  marginal  cost  (which  are  often  well  within  the  uncertainty  of 
the  data)  but  rather  on  how  sensitive  those  costs  will  be  to  changes 
in  key  variables  such  as  oil  price.  Basing  decisions  on  sensitivities 
enables  one  to  "play  safe"  in  an  uncertain  world.  In  general,  the 
variations  of  most  policy  interest,  such  as  high  world  oil  prices  or 
high  inflation,  tend  to  improve  the  competitive  position  of  renewables 
still  further.  Yet  soft  technologies  do  not  (as  Chapter  7.3.1  shows) 
require  such  assumptions  for  their  at t rac t i veness ,  since  they  can 
generally  compete  with  present  oil  prices  with  considerable  room  to 
spare. 

2.  Differences  of  internal  cost  may  be  less  important  to  many  nations 
than  differences  not  captured  in  that  cost — implications  for  resili¬ 
ence  and  self-reliance,  employment,  equity,  balance  of  trade,  etc. 

3.  In  general,  the  real  costs  of  fossil  and  nuclear  energy  are  likely  to 
rise  and  those  of  most  renewable  sources  to  fall.  The  relative  speeds 
of  change  in  both  cases  are  the  subject  of  great  uncertainty  and  dis¬ 
pute,  although  the  directions  of  change  are  empirically  undeniable  and 
the  fundamental  reasons  for  those  changes  are  all  but  certain  to 
persist . 

4.  In  general,  renewable  sources  offer  far  greater  scope  than  nonrenew¬ 
ables  for  simple,  low-technology  adaptations  suitable  for  local  con¬ 
struction  with  limited  skills  and  common  materials.  Such  simplified 
versions  cost  far  less  than  those  normally  analyzed;  they  are  more 
analogous  to  the  improvisations  commonly  made  by  individuals  at  a 
grassroots  level.  It  is  difficult  to  capture  the  enormous  range  of 
costs  reported  for  such  self-help  projects,  especially  those  done  by 
low-income  people  who  do  not  cost  their  own  labor  or  who  do  coopera¬ 
tive  projects.  But  in  general  the  real  costs  to  the  users  are  far 
less — even  orders  of  magnitude  less — than  for  conventional,  industri¬ 
ally  supplied  hardware,  and  the  performance  is  often  broadly  compar¬ 
able  and  sometimes  better. 

This  last  point  deserves  special  emphasis.  It  is  difficult  to  model,  but 
familiar  to  anyone  who  visits  community-based  energy  projects  or  who  reads  the 
many  journals  (New  Shelter,  Popular  Science,  Popular  Mechanics,  etc.)  devoted 
to  self-help  and  "vernacular  technology."  What  a  high  technologist  would  be 

likely  to  do  with  a  steel  tower,  an  aluminum  extrusion,  a  Fiberglas®  sheet,  or 


216 


a  piece  of  digital  recording  electronics  can  also  be  done  passably  well  with 
scrap  lumber  or  lashed  saplings,  a  piece  of  an  old  oil  drum,  a  sheet  of  cloth, 
or  a  person  with  pencil  and  paper.  High  technology  is  not  inconsistent  with 
cheapness  or  simplicity:  a  recently  developed  digital  recording  anemometer  for 
analyzing  proposed  windpower  sites  is  made  of  a  $4.95  calculator,  cups  from  two 
pantyhose  containers,  and  similar  odds  and  ends,  then  calibrated  by  driving  at 
known  speed  down  a  highway  on  a  calm  day  while  someone  holds  the  gadget  out  the 

window.  It  costs  in  all  around  $10,  but  performs  about  as  well  as  commercial 

versions  costing  many  hundreds  or  thousands  of  dollars.  There  are  tens  of 
millions  of  Americans  who  would  have  no  trouble  making  one.  Similarly,  the 
project  managers  for  some  fancy  Federal  solar  projects  were  amused,  on  visiting 
one  experimenter,  to  find  that  in  testing  solar  panels  he  measured  their  water 
flow,  not  with  their  fancy  digital  flowmeters,  but  with  a  bucket  and  stopwatch. 
They  were  less  amused  to  discover  that  the  National  Bureau  of  Standards  cali¬ 
brates  their  flowmeters  with  a  bucket  and  stopwatch. 

We  do  not  mean  to  dwell  unduly  on  "haywire  rigs"--the  kinds  of  technology 
that  can  be  put  together  from  things  that  are  lying  around  in  virtually  any 

farmyard  or  town  dump  in  the  world.  But  neither  can  their  potential  be  ignored 

in  favor  of  the  highly  refined  designs  more  familiar  to  well-funded  high  tech¬ 
nologists.  Whatever  they  may  think  of  these  odd-looking  improvisations,  they 
must  at  least  admit  that  oil  refineries,  reactors,  solar  power  satellites,  or 
multi-megawatt  wind  machines  do  not  offer  the  same  potential  for  simplified 
versions  at  greatly  reduced  cost.  That  potential  is  advantageous  enough  in 
normal  times;  in  emergencies  it  becomes  absolutely  vital. 

Subject  to  these  caveats  and  uncertainties — the  last,  the  immense  range  of 
technical  complexity  and  costs  over  which  many  renewable  options  can  be  built, 
being  perhaps  the  most  difficult  to  analyze — illuminating  comparisons  of  re¬ 
newable/nonrenewable  economics  are  in  fact  possible,  and  can  compensate  for 
fuzzy  data  with  multiple  conservatisms.  With  good  design  and  careful  shopping 
for  best  buys,  and  basing  responsible  analysis  on  empirical  data  (below),  many 
renewable  energy  systems  already  arguably  offer  a  pronounced  economic  advantage 
(especially  at  their  incremental  cost).  This  advantage  is  generally  increased 
by  doing  the  still  cheaper  efficiency  improvements  first.  This  economic  rank¬ 
ing  of  marginal  sources — efficiency  improvements  cheapest,  then  appropriate 
renewables,  then  nonrenewables  (synfuels  and  power  plants)  [Stobaugh  &  Yergin 
1979] — does  not  take  account  of  external  costs  and  benefits  not  currently 
reflected  in  market  prices.  Before  offering  some  illustrative  numbers  support¬ 
ing  our  generic  conclusions,  we  must  therefore  detour  briefly  into  what  these 
externalities  are  and  why  they  are  arguably  at  least  as  important  as  internal 


costs. 
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7.2.2.  External  costs  and  benefits. 

Economically  efficient  allocation  of  social  resources  requires  that  energy 
technologies  be  left  to  compete  freely  with  each  other  and  to  stand  or  fall  on 
their  economic  merits.  But  market  prices  do  not  reflect,  and  are  not  meant  to 
reflect,  many  important  social  costs  and  benefits.  Even  if  thev  did,  an  eco¬ 
nomically  efficient  result  might  not  be  equitable,  and  cannot  be  expected  al¬ 
ways  to  coincide  with  the  results  of  the  political  process,  which  is  designed 
to  reflect  and  protect  a  broad  range  of  interests  not  represented  in  market 
processes.  A  democracy  works  by  "one  person,  one  vote,"  but  the  marketplace 
works  by  "one  dollar,  one  vote,"  and  the  dollars  are  not  evenly  distributed 
among  the  people.  To  increase  equity,  political  compatibility,  and  correct 
long-term  distributions  of  resources  (which  is  not  something  markets  do  partic¬ 
ularly  well),  it  is  therefore  important  at  least  to  recognize  some  of  the  main 
external  costs  and  benefits  of  alternative  energy  technologies. 

In  economic  formalism,  it  is  not  correct  to  count  employment  as  a  benefit 
of  any  project:  it  is  treated  (and  must  be  for  theoretical  consistency)  not  as 
a  benefit  but  as  one  of  the  costs  of  production,  in  the  form  of  wages,  salar¬ 
ies,  and  benefits  whose  payment  causes  some  other  useful  output  to  be  foregone. 
The  amount,  duration,  location,  and  quality  of  work  provided  by  energy  projects 
are  nonetheless  socially  and  politically  important.  Such  projects  can  either 
increase  or  decrease  total  employment.  Power  stations,  for  example,  are  so 
capital-intensive  that  each  GWe  built  destroys  about  4000  net  jobs  by  starving 
other  sectors  for  capital  [Hannon  1976].  In  contrast,  careful  and  detailed 
case-studies  [ Buchsbaum  et  al .  1979;  Schachter  1979],  confirmed  by  more  aggre¬ 
gated  calculations  [Rodberg  1978;  Brooks  1981:154-167],  have  shown  that  effi¬ 
ciency  and  soft-technology  investments  provide  several  times  as  many  jobs  per 
kW  as  powei — station  investments,  but  better  distributed  by  location  and  occupa¬ 
tion  [Congressional  Research  Service  1978:212-219]  and  arguably  offering  more 
scope  for  individual  responsibility  and  initiative.  It  is  partly  for  this 
reason  that  many  progressive  U.S.  labor  unions  (e.g.  United  Auto  Workers,  Aero¬ 
space  &  Machinists,  Sheet  Metal  Workers)  support  a  "soft  energy  path." 

Another  important  consideration  is  the  program's  macroeconomic  effects  via 
spending  patterns  and  interest  rates.  (Respending  effects — how  people  spend 
the  money  they  save  by  using  energy  more  efficiently — are  important  to  the  job 
analyses.)  In  general,  efficiency  and  soft-technology  investments  are  counter¬ 
in  f  l  at  ionarv  :  once  in  place  they  provide  energy  services  at  little  or  no 
additional  cost,  regardless  of  the  price  of  depletable  fuels.  The  relatively 
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short  construction  time  and  fast  payback  of  these  investments  also  tends  to 
reduce  pressure  on  interest  rates.  Kahn  etal .  [1980]  have  shown  explicitly 
that  an  electric  utility  in  financial  difficulties  (Appendix  A)  can  increase 
the  present  value  of  its  cash-flow  severalfold  by  cancelling  long-lead-time 
plant  construction  and  spending  the  money  instead  on  e f f i c iency/sol ar  invest¬ 
ments,  which  turn  over  money  very  quickly.  The  saving  from  those  investments 
is  not  only  immediate  and  continuous;  it  is  also  widely  distributed  throughout 
society  rather  than  concentrated  in  a  few  industrial  sectors  or  localities. 

Efficiency  improvements  and  soft  technologies  have  very  much  lower  and 
more  manageable  risks  to  occupational  and  public  safety  [Holdren  et  al .  1980] 
and  to  the  environment  generally  [id.]  than  do  competing  nonrenewable  sources, 
even  with  stringent  controls.  A  combined  strategy  of  efficiency  and  renewables 
offers  a  potent  way  of  avoiding  global  climatic  change  [Lovins  et  al .  1981], 

And  if  coupled  with  recognition  of  the  economic  realities  of  the  utility  and 
nuclear  sectors  and  of  the  problems  posed  by  the  strategic  arms  race,  such  an 
energy  policy  is  also  the  most  effective  means  so  far  proposed  of  limiting  or 
even  reversing  the  proliferation  of  nuclear  weapons  [Lovins  &  Lovi/is  1980]. 

Other  geopolitical  implications  of  such  a  strategy  are  also  important. 

For  example,  both  directly  and  by  example,  it  could  strongly  influence  U.S. 
allies  towards  a  more  sustainable  energy  policy:  such  countries  as  Britain, 
France,  West  Germany,  and  Japan  all  turn  out  to  be  able  to  provide  essentially 
all  their  energy  services  using  presently  available  and  cost-effective  effi¬ 
ciency  and  renewable  technologies  [Lovins  et  al .  1981]  .  The  attractions  of 
such  technologies  for  developing  countries  have  been  extensively  documented 
[ id . ;  Lovins  &  Lovins  1980],  The  Office  of  Technology  Assessment  [1978]  has 
noted  [Congressional  Research  Service  1978:199-209]  the  special  advantages  of 
independence  from  fuel  and  technology  imports.  "Solar  energy  is  the  one  energy 
resource  which  is  reliably  available  wor ldwide"--general ly  in  larger  and  more 
consistent  amounts  in  most  developing  countries  than  in  the  U.S.  [ id  .  : 204]  ,  and 
competing  with  far  higher  than  U.S.  fuel  prices.  The  advantages  of  soft  tech¬ 
nologies  for  rural-based  development,  for  integration  with  agriculture,  and  for 
simplified  versions  using  locally  available  materials  would  be  especially 
striking  in  developing  countries  [_id^:208;  Lovins  et  al  .  1981].  One  result 
directly  relevant  to  U.S.  security  would  be  the  partial  relief  of  the  Third 
World  frustration  and  desperation  which  could  otherwise  serve  as  a  breeding- 
ground  for  revolutionary  doctrines. 

Similar  arguments  apply  within  American  society  itself.  Technologies 
which  tend  to  improve  distributional  equity,  which  are  equally  available  to 
persons  of  all  income  levels,  which  increase  individual  and  community  self- 
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reliance  and  self-esteem,  and  which  by  their  appropriate  scale  allocate  energy 
and  its  side-effects  more  equitably  will  all  tend  to  reduce  the  tensions  now 
leading  to  "energy  wars"  (pp,  26,  153).  Technologies  which  are  perceived  to 
be  relatively  benign,  whose  impacts  are  directly  sensible  and  understandable  by 
ordinary  people,  and  which  are  accessible  to  an  accountable  and  locally  respon¬ 
sive  political  process  [Lovins  1977b]  would  increase  the  likelihood  that  poli¬ 
tical  conflicts  over  energy  policy  (Chapter  2.1.2)  would  be  settled  peacefully. 
And  technologies  which  can  be  evolved,  refined,  and  selected  largely  by  the 
processes  of  the  marketplace,  rather  than  by  the  technocratic  mandate  of  an 
Energy  Security  Corporation  and  an  Energy  Mobilization  Board,  are  more  likely 
not  only  to  respect  our  national  pluralism  and  diversity  but  also  to  use 
national  resources  efficiently.  To  see  the  dangers  of  central  crash  programs 
one  need  look  no  further  than  the  experience  of  World  War  II  [Congressional 
Research  Service  1978:310-329],  when  the  War  Production  Board,  despite  great 
talent  and  effort,  mandated  industrial  expansions  and  conversions  "which  we 
could  not  use  and  did  not  need,"  diverting  precious  resources  from  other  uses 
where  they  were  more  urgently  needed  and  failing  to  use  efficiently  the  con¬ 
siderable  capacities  of  many  small  manufacturers  [  id  . :  3  7  7 ]  . 

A  final  consideration  important  for  policy,  though  difficult  to  quantify, 
is  the  risk  of  technological  failure.  It  is  sometimes  suggested  that  efficien¬ 
cy  improvements  and  soft  technologies  are  uncertain  to  succeed,  and  that  reli¬ 
ance  on  them  is  therefore  a  risky  gamble.  On  the  contrary,  such  technologies 
are  known  to  work.  (They  embody  more  often  the  technologies  of  the  1890s  than 
of  the  1990s:  nearly  a  third  of  the  houses  in  Pasadena,  California  had  solar 
water  heaters  in  1897  [Butti  &  Perlin  1980 1 )  .  The  extensions  and  modifications 
that  would  benefit  many  of  them  are  of  a  modest  character  unlikely  to  present 
any  substantive  engineering  problems.  And  the  enormous  diversity  of  the 
technologies  and  of  the  policy  instruments  that  can  be  used  to  implement  them 
provides  many  fallback  routes  to  reach  the  same  goals.  In  contrast,  it  is 
conventional  energy  supply  technologies  whose  success  hangs  on  adventurous 
extensions  of  the  present  engineering  art  into  wholly  uncharted  regions  where 
success  is  far  from  certain — the  conditions  of  stormy  seas,  the  Arctic, 
fast-neutron  fluxes,  shale  mining,  corrosive  hot  brines,  synfuel  processing, 
outer-space  industrialization.  It  is  those  same  technologies  that  must 
overcome  formidable  sociopolitical  obstacles  against  even  longer  odds.  And  it 
is  again  those  same  technologies  which  stake  the  energy  future  on  technical, 
social,  and  economic  breakthroughs  far  surpassing  anything  yet  experienced. 

Those  who  advocate  even  greater  reliance  on  such  technologies  have  already 
brought  us  the  greatest  collapse  in  industrial  history:  a  nuclear  enterprise 
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which,  after  the  investment  of  enormous  technical  effort  and  hundreds  of  bil¬ 
lions  of  dollars,  finds  itself  with  no  vendor  in  the  world  that  has  made  a  pro¬ 
fit  on  reactor  sales,  with  at  least  fifty  more  reactors  cancelled  than  ordered 
in  the  U.S.  since  1974,  and  with  a  similar  collapse  of  prospects  throughout 
the  world's  market  economies  [Lovins  4  Lovins  1980],  This  unhappy  episode 
underscores  the  risks  of  underestimating  the  challenges  of  "big  engineering" 

[ Bupp  &  Derian  1978],  assuming  that  capital  markets  will  indefinitely  ignore 
the  bottom  line,  and  neglecting  the  social  realities  that  make  it  more  diffi¬ 
cult  to  achieve  a  plutonium  economy  than  to  insulate  houses.  Although  it  may 
at  first  glance  appear  that  the  "hard"  technologies  require  merely  continuing 
to  do  as  one  has  previously  done,  while  the  alternatives  require  striking  out 
into  new  territory,  a  pragmatic  assessment  of  what  is  actually  working  tells 
the  opposite  story.  The  contrast  between  one  set  of  technologies,  failing  to 
meet  the  test  of  the  marketplace  despite  lavish  subsidies,  and  the  other, 
capturing  the  market  despite  discriminatory  institutional  barriers,  could  not 
be  more  complete.  Efficiency  and  renewables  are  not  only  the  line  of  least 
resistance  but  also  the  policy  of  least  risk. 

7.2.3.  System  integration  issues. 

A  full  assessment  of  inherently  resilient  energy  sources  must  consider 
what  opportunities  and  problems  may  arise  as  such  sources  are  gradually  inte¬ 
grated  into  an  entire  energy  system,  combining  them  with  each  other,  with 
existing  energy  devices  and  networks,  and  with  other  infrastructure  such  as 
buildings  and  farms.  Although  such  issues  can  become  exceedingly  complex,  we 
shall  highlight  by  illustration  some  of  the  possible  forms  of  integration  that 
can  improve  system  economics. 

We  have  already  mentioned  that  renewable  space-conditioning  systems,  espe¬ 
cially  those  using  passive  solar  techniques  [Department  of  Energy  1980;  Cali¬ 
fornia  Energy  Commission  1980]  ,  can  be  integrated  with  other  features  of  a  new 
or  existing  building  so  as  to  save  materials  and  money.  Attached  greenhouses, 
for  example,  can  provide  most  or  all  of  a  house's  space  heating,  a  frostproof 
site  for  a  solar  water-heater,  a  cheery  "sunspace"  that  extends  living  space 
year-round,  and  a  place  to  grow  food  in  all  seasons  [OTA  1981;  Yanda  &  Fisher 
1980].  In  such  a  building,  simple  plastic-composite  sheets  can  be  used  to  form 
freestanding  water  tanks,  usable  both  for  heat  storage  (as  passive-solar  "ther¬ 
mal  flywheels")  and  for  aquaculture.  In  one  Cape  Cod  design,  each  tank  pays 
for  itself  annually  by  its  oil  saving  or  its  fish  production,  with  the  other 
function  provided  free.  Some  houses  are  now  integrating  food  production  with 


now  coin- 
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water  recycling  or  sewage  treatment:  water  hyacinth  treatment  plants, 
mercially  available  [OTA  1981],  provide  better  water  quality  than  costly  and 
energy-intensive  tertiary  treatment  plants,  while  sequestering  heavy  metals  and 
providing  a  feedstock  for  producing  methane  fuel  and  fertilizer. 

The  opportunities  for  multiplying  functions  and  saving  energy  and  money 
are  almost  unlimited.  A  dairy  farm  in  Pennsylvania,  for  example,  like  others 
in  Europe,  uses  an  anerobic  digester  to  convert  manure  to  an  improved  fertili¬ 
zer  plus  methane  gas.  The  methane  runs  a  diesel  generator  which  powers  the 
farm  (many  such  operations  produce  an  exportable  surplus).  The  generator's 
waste  heat  makes  hot  water  to  wash  the  milking  equipment  (some  farms  use  it  in 
pasteurizing).  Waste  heat  from  the  washwater  is  then  recovered  and  used  to 
preheat  the  cows'  drinking  water  so  as  to  increase  the  milk  yield.  A  further 
project  now  being  pursued  will  integrate  these  functions  with  on-farm  produc¬ 
tion  of  fuel  alcohols  from  crop  wastes,  cascading  process  heat  and  sharing 
other  infrastructure,  then  using  the  alcohols  to  run  farm  vehicles  and  to  sell 
as  an  additional  export.  Another  common  form  of  dairy-farm  integration  is  to 
heat  the  anerobic  digester  in  the  winter  with  waste  heat  from  the  milk  chiller 
(a  giant  refrigerator,  legally  required  in  many  states).  This  often  boosts  the 
methane  yield  so  much  that  one  farm's  output  can  meet  all  its  own  energy  needs 
— before  efficiency  improvements — plus  those  of  six  other  farms.  Still  another 
common  pattern  integrates  the  wet  or  dried  residues  of  alcohol  distillation 
into  the  feeding  cycle  (the  high  yeast  content  makes  it  a  premium,  high-protein 
feed).  The  carbon  dioxide  from  fermentation  can  also  be  sold  to  refrigerant  or 
soft-drink  companies  or  used  to  increase  the  food  output  of  a  greenhouse. 

Similarly  ingenious — and  thrifty — cascading  of  heat  through  a  series  of 
tasks  at  successively  lower  temperatures  is  the  principle  of  industrial  cogen¬ 
eration  [Williams  1978].  This  energy-  and  money-saving  technology  [Machalaba 
1979]  replaces  two  separate  boilers — one  in  a  factory  and  another  in  a  power 
station — with  one  in  common,  producing  process  heat  or  steam  with  electricity 
as  a  byproduct.  Three-fourths  or  more  of  the  energy  in  the  initial  fuel  is  then 
harnessed,  not  just  a  third.  Air-conditioning  or  desalination  can  be  further 
byproducts  [Diesel  &  Gas  Turbine  Progress  1973]  . 

The  same  objective  can  be  achieved  by  using  for  space-conditioning  the 
1 ow-temperature  waste  heat  from  a  plant  used  primarily  to  generate  electricity. 
Some  such  systems  [Energy  6  Defense  Project  1980:167-169]  achieve  about  90% 
overall  energy  efficiency,  are  designed  at  the  scale  of  a  single  apartment 
house,  and  use  standard  automotive  engines  burning  a  wide  range  of  liquid  or 
gaseous  fuels.  Current  prices  are  about  $10,000  for  15  kWe  +  38  kWt  [ Popular 
Sc  ience  1981],  making  the  systems  attractive  despite  their  limited  lifetime. 
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Either  kind  of  cogeneration — using  low-temperature  waste  heat  from  a  gen¬ 
erator  or  using  a  topping  cycle  to  make  electricity  before  using  high-tempera- 
ture  industrial  heat — can  also  be  used  with  renewable  energy  sources.  For  ex¬ 
ample,  the  medium-  or  low-temperature  waste  heat  from  a  low-ratio  optical  con¬ 
centrator  (which  can  improve  the  economics  of  solar  cells)  can  offer  an  addi¬ 
tional  economic  credit  for  domestic  space  and  water  heating,  as  noted  below. 
High-ratio  optical  concentrators  to  make  high-temperature  solar  process  heat 
can  make  electricity  first,  just  as  if  the  heat  were  from  a  fossil-fueled  boil¬ 
er.  Such  solar  process  heat  is  also  well  suited  to  increasing  the  yield  of 
bioconversion  processes,  as  Prof.  Michael  Antal  of  Princeton  University  has 
noted.  Prof.  Sven  Eketorp  (Royal  Swedish  Institute  of  Technology,  Stockholm)  is 
even  exploring  modernized  steelmaking  with  charcoal  from  wood:  with  no  sulfur, 
the  steel  is  of  better  quality,  and  copious  fuel  gas  is  a  free  byproduct. 

Still  another  integration  opportunity  arises  where  wood  wastes  are  burned 
for  industrial  cogeneration — an  increasingly  common  practice  in  the  forest  pro¬ 
ducts  industry.  It  appears  possible  to  cascade  process  heat  to  produce  methan¬ 
ol  as  a  cheap  liquid-fuel  byproduct  from  some  of  the  "junk"  wood  input.  This 
could  also  be  done  in  the  kind  of  small  (tens  of  MWe)  wood-fired  power  station 
proposed  for  some  northern  states  and  eastern  Canadian  Provinces.  Indeed,  if 
properly  sited,  such  plants  could  simultaneously  produce,  at  much  reduced  cost, 
electricity,  methanol,  and  space  heat,  thus  replacing  all  three  of  the  main 
local  uses  of  oil.  Such  an  arrangement,  like  industrial  cogeneration,  obvious¬ 
ly  increases  the  resilience  of  the  power  grid  by  adding  a  diverse,  localized 
source  that  can  operate  in  isolation.  The  increasing  use  of  cogeneration  in 
oil  refineries  also  reduces  possible  spillover  of  electric-grid  failures  into 
the  oil  system.  Proposed  uses  of  solar  process  heat  in  enhanced  oil  recovery 
would  offer  the  same  advantage,  and  are  encouraged  by  overlapping  tax  subsidies 
offered  both  for  the  oil  recovery  and  for  the  solar  components. 

We  have  referred  several  times  co  the  use  of  low-temperature  waste  heat  in 
buildings  without  mentioning  that  this  can  readily  be  done  not  only  at  the 
scale  of  one  or  several  buildings  but  of  an  entire  town  or  city.  This  is  com¬ 
monly  done  in  Europe,  and  especially  in  Scandinavia.  Sweden,  widely  regarded 
as  the  leader  in  district  heating  technology,  is  in  the  middle  of  a  ten-year 
program  of  converting  all  cities  of  over  100,000  to  district  heating  (Stockholm 
will  take  twenty  years).  This  process  is  using  special  inst i tut i onal  d  tech¬ 

nical  innovations.  The  latter  include  highly  insulated  flexible  pipes  which 
can  be  laid  relatively  cheaply  over  large  areas,  even  at  low  suburban  densi¬ 
ties,  to  carry  pressurized  hot  water.  (Steam  systems  are  usually  considered 
obsolete.)  Many  Swedish  boilers  providing  district  heating,  with  or  without 
electricity,  can  burn  a  wide  range  of  fuels,  including  municipal  wastes  and 
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wood  chips.  Cheap  backup  boilers  are  also  commonly  provided  to  ensure  reliable 
service,  and  there  is  usually  redundant  pumping  capacity.  An  experimental 
boiler  at  EnkBping  achieves  extraordinary  fuel  versatility,  with  high  effi¬ 
ciency  and  cleanliness,  through  fluidized-bed  combustion.  The  Swedish  District 
Heating  Association  has  shown  great  foresight  by  recommending  that  new  district 
heating  systems  be  designed  to  be  easily  convertible  to  solar  district  heating 
later.  Several  solar  district  heating  systems  are  in  operation  or  construc¬ 
tion,  mainly  in  Scandinavia  [Margen  1980;  Gleason  1981 , 1981a , 1981b]  . 

Several  analyses  have  found  that  solar  district  heating  can  cut  the  deliv¬ 
ered  cost  of  active  solar  heat  roughly  in  half  (Hollands  &  Orgill  1977;  Office 
of  Technology  Assessment  1978].  An  analysis  of  the  physics  involved  [Lovins 
1978:492]  found  that  a  large  water  tank,  shared  between  tens  or  hundreds  of 
dwellings,  provides  (in  comparison  with  a  single  house's  small  tank)  a  large 
volume-to-sur face  ratio,  hence  low  heat  losses;  has  low  marginal  cost  per  unit 
of  volume;  and  has  a  favorable  ratio  of  variable  to  fixed  costs.  One  can  there¬ 
fore  afford  to  use  several  m^  of  storage  volume  per  m^  of  collector 
area,  rather  than  a  ratio  of  typically  0.5-0. 8  in  single  houses  with  quasi- 
seasonal  storage,  like  the  Saskatchewan  Conservation  House.  The  increased  stor¬ 
age  volume  then  provides  true  seasonal  storage  from  summer  through  winter.  This 
in  turn  provides  a  full  summer  load,  improving  annual  collector  efficiency.  It 
permits  further  efficiency  gains  by  separating  the  storage  volume  into  differ¬ 
ent  zones  with  the  hottest  water  near  the  center  and  the  coolest  near  the  peri¬ 
phery:  this  improves  collector  performance  and  further  reduces  heat  losses. 
Finally,  true  seasonal  storage  makes  it  possible  to  orient  collectors  east  or 
west  rather  than  towards  the  Equator  with  only  a  small  performance  penalty, 
simplifying  urban  retrofits.  The  net  result  of  all  these  effects  is  a  marked 
cost  reduction,  probably  to  levels  well  below  the  oil  prices  of  a  few  years  ago 
[Hollands  &  Orgill  1977].  Incorporation  of  solar  ponds  (Chapter  7.3.2)  or  ice 
ponds  or  both  [Taylor  &  Taylor  1981]  would  cut  costs  still  further,  and  would 
incorporate  energy  collection  and  energy  storage  into  the  same  device. 

People  unused  to  thinking  about  the  variability  of  renewable  energy  flows 
often  assume  that  integrating  renewable  sources  into  the  existing  energy  sys¬ 
tem,  especially  the  electric  grid,  would  make  service  less  reliable  because 
many  renewable  sources  are  intermittent,  dependent  on  vagaries  of  weather.  This 
intermittence  is  presumed  to  require  full  conventional  backup  (negating  the  re¬ 
newable  sources'  ostensible  capacity  saving),  or  enormous  amounts  of  energy 
storage,  or  both.  In  fact,  as  noted  earlier,  renewable  sources  even  in  a  small 
geographic  area  tend  to  complement  each  other,  and  their  interruptions  are 
briefer,  more  predictable,  and  quantized  in  smaller  units  than  the  interrup- 
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t ions  of  conventional  sources  by  technical  breakdowns,  oil  embargoes,  strikes, 
etc.  This  has  been  borne  out  by  detailed  analyses  [Kahn  1978,1979;  Sorensen 
1979;  Diesendorf  1981;  Systems  Control  1980). 

Indeed,  viewed  more  broadly,  the  need  for  energy  storage  is  a  far  worse 
problem  in  conventionally  projected  systems.  Their  reliance  on  extensive  cen¬ 
tral  electrification  requires  [Ryle  1977}  vast  amounts  of  very  awkward  and 
costly  electrical  storage.  In  contrast,  with  economically  efficient  energy 
use,  electrical  demand  would  be  so  greatly  reduced  (Appendix  A)  that  the  grid 
would  be  dominated  by  present  and  small-scale  hydroelectric  supply,  permitting 
storage  in  the  form  of  water  behind  dams  at  no  extra  cost.  (Kahn  [1978,1979] 
notes,  however,  that  in  such  a  system  the  optimal  ratio  of  the  dams'  peak  out¬ 
put  capacity  to  their  impoundment  volume  may  well  change.)  Liquid  fuels  store 
themselves.  Heat  storage  for  days  or  weeks,  in  rocks,  molten  salts  or  metals, 
etc.  is  straightforward  [Office  of  Technology  Assessment  1978]  and  not  unduly 
costly — given  efficient  use.  In  short,  an  economically  efficient  combination 
of  investments  in  energy  productivity  and  renewable  supply  can  reduce  the 
energy  storage  problem  from  the  intractable  levels  which  reliable  service  would 
demand  if  present  policies  were  pursued.  The  storage  which  would  be  needed  in 
a  soft  energy  path  would  tend  to  be  relatively  dispersed  and  invulnerable. 

The  most  complex  integration  issues,  extending  well  beyond  traditional 
reliability  considerations,  arise  with  electrical  systems — both  because  of  the 
need  for  grid  synchronization  and  because  electricity,  being  generated  and  used 
at  essentially  the  same  instant,  requires  rapid  regulation  to  ensure  a  balance 
between  fluctuating  demand  and  fluctuating  supply.  Hardware  is  moving  so  much 
faster  than  analysis  that  we  already  have  attractive  dispersed  electrical  sour¬ 
ces  (such  as  cogeneration,  microhydro,  and  wind),  and  shall  soon  have  more 
(such  as  competitive  solar  cells),  before  we  know  how  best  to  use  them.  There 
is  a  legal  framework — notably  the  Public  Utility  Regulatory  Policies  Act  of 
1978 — encouraging  the  interconnection  of  such  sources  and  compelling  utilities 
to  buy  back  their  surplus  power  at  the  utilities'  own  "avoided  cost"  [Prompt ing 
Small  Power  Production  1981],  and  specific  technical  arrangements  for  inter¬ 
change  are  starting  to  emerge  [ Sun*Up  1981].  Some  utilities  [e.g.  Southern 
California  Edison  Co.  1980]  are  already  planning  to  put  numerous  renewable 
devices  of  their  own  onto  their  grid.  Yet  the  optimal  method  of  connecting  and 
using  these  sources  is  not  yet  known.  Should  they  be  integrated  with  the  grid, 
or  isolated  from  it — providing  local  storage  and  operating  end-use  devices  on 
low-voltage  DC?  This  is  still  an  open  question. 

Some  previously  controversial  issues  have  recently  been  settled:  for 
example  [Systems  Control  1980,1980b],  by  showing  how  to  ensure  the  safety  of 
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utility  personnel  working  on  grid  sections  that  might  be  energized  bv  dispersed 
sources  during  a  grid  failure;  or  why  such  sources  will  not  damage  the  grid  or 
disturb  its  proper  regulation;  or  how  to  avoid  feeding  damaging  harmonics  into 
the  grid.  But  much  more  fundamental  theoretical  and  practical  questions  re¬ 
main.  While  such  devices  as  DC-to-AC  inverters  have  been  used  for  decades  to 
connect  DC  sources  to  the  grid,  and  some  of  America’s  cumulative  total  of  six 
million  wind  machines  have  been  grid-connected,  merely  having  feasible  methods 
for  interconnection  is  not  the  same  as  knowing  which  methods  are  best  where. 

This  question  is  far  more  complex  than  may  at  first  appear,  partly  because 
there  are  so  many  ways  of  interconnecting  sources  and  grid  [id.;  Systems  Con¬ 
trol  1980].  Dispersed  sources  can  generate  electricity  as  low-voltage  DC,  e.g. 
using  a  fuel  cell  or  solar  cells  or  a  DC  generator,  perhaps  buffered  by  storage 
in  a  battery  bank.  The  direct  current  can  then  be  optionally  converted  to 
line-voltage  AC  using  an  inverter.  This  can  be  synchronized  by  the  line  volt¬ 
age  itself,  by  radio  signals,  or  by  the  line  voltage  as  processed  through  a 
microcomputer  (perhaps  the  most  versatile  method);  some  inverters  also  produce 
approximately  the  correct  frequency  even  if  not  connected  to  the  grid.  Alterna¬ 
tively,  dispersed  sources  can  generate  AC  directly  using  a  synchronous  or  in¬ 
duction  generator  [Systems  Control  1980:5-16  f f ]  .  The  former,  the  type  used  in 
large  power  plants,  requires  shaft  rotation  at  a  constant  speed  (3600  rpm 
divided  by  the  number  of  pole  pairs  in  the  generator),  but  it  can  operate  and 
can  supply  local  loads  in  isolation  from  the  grid.  It  can  be  connected  with 
the  grid  only  if  its  speed,  voltage,  and  phase  angle  are  first  matched  to  those 
of  the  grid.  Induction  generators,  on  the  other  hand,  must  be  driven  slightly 
faster  than  the  synchronous  speed  (otherwise  they  run  backwards  as  motors) ,  so 
they  cannot  operate  independently  of  the  grid,  but  they  do  not  need  to  be  syn¬ 
chronized  before  connection  with  it,  and  are  simpler  and  cheaper  than  synchro¬ 
nous  generators. 

A  further  complication  is  that  one  must  consider  the  source's  relationship 
not  only  with  the  grid  but  with  end-use  devices.  In  general,  electronics  and 
some  industrial  processes,  such  as  electroplating,  require  low-voltage  DC  and 
must  currently  obtain  it  by  rectifying  and  filtering  AC  from  the  grid.  Consumer 
electronic  devices  could  be  built  cheaper  and  their  weight  and  copper  consump¬ 
tion  considerably  reduced  if  the  AC-to-DC  power  supplies  were  omitted;  given  a 
market,  such  an  option  may  become  available.  Motors,  depending  on  type,  may 
require  DC,  AC,  or  either*.  AC  is  more  common;  some  motors  require  it  at  fixed 
60-Hz  line  frequency,  while  others,  within  limits,  can  operate  from  the  "wild" 
frequency  of  an  unregulated  generator.  (Some  household  wind  machines  use  this 
system,  but  the  generator  can  lock  to  grid  frequency  when  connected  to  it.)  DC 


*Most  household  appliances,  including  e.g.  washing  machines,  used  to  come  in 
32-VDC  models  matching  widely  used  pre-REA  wind  machines. 
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motors,  especially  in  small  sizes,  tend  to  be  relatively  scarce  and  expensive 
(military  surplus  is  the  traditional  source),  but  inventors  at  NASA  and  else¬ 
where  have  developed  plug-in  solid-state  "smart  inverters,"  now  entering  the 
market  for  less  than  the  incremental  cost  of  DC  motors,  which  enable  standard 
AC  motors  to  run  very  efficiently  on  low-voltage  DC.  Incandescent  lights  run 
on  either  AC  or  DC,  given  the  right  voltage.  Fluorescent  lights  normally  use 
60-Hz  AC,  but  new  versions  use  their  own  AC-to-AC  or  DC-to-AC  inverters  to  pro¬ 
vide  a  high-frequency  (400  Hz  and  up)  output  which  boosts  efficiency.  (Hand¬ 
held  fluorescent  camping  lanterns  are  of  this  type — hence  their  high-pitched 
whine.)  An  AC  generator  requires  the  least  adaptation  of  standard  household 
and  office  equipment  but  tends  to  encourage  or  even  require  grid  integration 
whether  it  is  economically  optimal  or  not.  A  DC  generator  can  operate  DC 
end-use  devices  (such  as  most  electronics)  and  connect  to  battery  storage 
directly;  can  operate  AC  end-use  devices  through  a  small  inverter,  such  as 
those  commonly  used  to  operate  household  appliances  from  car  or  boat  current; 
and  can  connect  with  the  grid  via  another  inverter.  Which  approach  is  optimal 
will  depend  strongly  on  local  circumstances,  especially  the  proposed  end-uses. 

Although  the  technical  problems  of  grid  interface  [Systems  Control  1980] 
can  be  straightforwardly  solved  by  hardware  on  or  about  to  come  on  the  market, 
most  manufacturers  have  so  far  given  too  little  attention  to  integration  and 
"balance-of-system"  issues.  This  is  likely  to  be  corrected  as  more  solar-cell 
manufacturers  begin  to  sell  "packaged"  systems  including  a  range  of  power-con¬ 
ditioning,  storage,  control,  and  end-use  equipment  compatible  with  their 
solar-cell  arrays.  There  is  currently  rather  a  narrow  range  of  inverters  on 
the  market,  and  some  common  models,  such  as  the  Gemini™,  were  designed  for  wind 
machines  and  may  not  work  well  with  solar  cells.  Better  designs  exist: 

Hitachi,  for  example,  sells  in  Japan  (but  not  in  the  U.S.)  a  chip-controlled 
inverter  which  digitally  generates  a  99+%-pure  sine  wave  and  responds  in  a 
fraction  of  a  cycle  to  any  change  in  the  size  or  reactance  of  the  load.  The 
Sandia  experts  who  design  inverters  for  U.S.  nuclear  weapons  are  also  turning 
their  attention  to  inverters  for  renewable  energy  sources.  The  market  range  of 
efficient,  versatile  inverters,  including  those  amenable  to  remote  control  by 
utility  signals,  is  therefore  likely  to  increase  rapidly  in  the  next  few  years. 
This  will  not,  however,  be  a  complete  solution  to  the  broader  problem  of  making 
sources,  grid,  end-user  wiring  and  controls,  and  end-use  devices  fully  compati¬ 
ble  with  whatever  AC,  DC,  or  hybrid  systems  emerge  as  standard. 

The  potential  of  dispersed  renewables  to  reduce  the  vulnerability  of  the 
electric  grid  will  not  be  fully  realized  if  the  rapid  and  somewhat  hapazard 
evolution  of  grid- inter  face  devices  and  system  concepts  continues  to  ignore 
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preparedness  issues.  Three  issues  stand  out  here.  First,  there  is  little  ef¬ 
fort  at  standardization,  and  different  manufacturers  may  end  up  making  incom¬ 
patible  equipment — restricting  opportunities  for  improvisation  and  for  moving 
equipment  from  one  site  to  another  in  emergencies.  Second,  many  preparedness 
options  are  being  ignored:  no  thought  seems  to  have  been  given,  for  example,  to 
making  DC  voltages  and  hookups  compatible  with  automobile  electrical  systems; 
providing  accessible  and  foolproof  terminals  (and  instruct  ions)  to  facilitate 
such  emergency  interconnections  with  a  car  battery  or  alternator;  designing 
grid  inverters  and  controls  to  be  resistant  to  EMP  damage  (p.  96);  and  encoura¬ 
ging  designs  which,  without  endangering  utility  personnel,  can  operate  indepen¬ 
dently  of  the  grid,  serving  local  loads  in  isolation.  On  the  contrary,  present 
practice,  to  protect  utility  personnel  in  a  way  better  achieved  by  isolation 
relays,  encourages  induction-backfeed  generators  and  line-driven  inverters — 
guaranteeing  that  if  the  grid  crashed,  renewable  sources  could  not  operate  at 
all,  even  to  serve  local  loads.  Third,  although  current  standards  of  grid 
reliability  exceed  any  economically  worthwhile  value  [Telson  1975],  and  relaxed 
reliability  standards  would  improve  still  further  the  economics  of  intermittent 
renewable  sources  (Kahn  1978:338f],  little  thought  is  being  devoted  to  seeking 
more  sensible  reliability  standards  better  suited  to  heterogeneous  needs*. 

Dispersed  renewable  sources  can  prevent  or  mitigate  cascading  grid  fail¬ 
ures  only  if  proper  attention  is  paid  at  an  early  stage  to  how  they  are  con¬ 
nected  into  it.  The  importance  of  these  issues  is  emphasized  in  a  major  ana¬ 
lysis  of  such  sources'  role  [Systems  Control  1980).  The  study  found  [  : 5—50 ] 
that  "There  is  no  question  that  [ they ].. .would  have  helped  greatly  [in  the  July 
1977  New  York  blackout]  provided  that  they  had  been  properly  integrated  into 
the  power  system  under  conditions  of  cascading  outage.  This  means  that  fail¬ 
safe  procedures  must  exist  to  ensure  that  [the  dispersed  sources) .. .cont inue  to 
f unct ion . . .and  are,  in  fact,  connected  to  the  essential  loads,  e.g.  buildings, 
government  services,  traffic  lights,  etc.  Corwin  et  al . . . .est imate  that  the 
economic  loss  caused  by  the  disappearance  of  these  essential  services  constitu- 
tuted  roughly  [83%  of  the  direct  losses  in  the  New  York  blackout] ... .The  total 
demand  for  essential  services  is  estimated  L  ■>  be  in  the  range  of  several  per¬ 
cent  of  total  demand.  Thus,  [in  New  York]  several  hundred  megawatts  of  [dis¬ 
uses  requiring  high  reliability  could  get  it  more  cheaply  with  local  storage 
or  standby  capacity,  as  telephone  exchanges,  hospitals,  etc.  do  now:  it  is 
cheaper  to  provide  extra  reliability  in  some  places  than  maximal  reliability 
everywhere  as  in  the  present  grid.  Similar  considerations  apply  to  voltage, 
frequency  (p.  47),  and  phase  stability.  In  an  era  of  cheap  digital  electron¬ 
ics,  it  no  longer  makes  economic  sense  to  use  the  grid  as  a  universal  clock. 
Yet  new  turbogenerator  designs  are  locking  us  into  extremely  stringent  stand¬ 
ards  for  decades  to  come,  complicating  the  interface  with  renewables.  If  it 
turns  out  that  phase  and  frequency  stability  need  to  be  "stiffened"  in  a  grid 
eventually  dominated  by  large  numbers  of  independent  renewable  sources,  motcr- 
generator  sets  with  large  flywheels  might  suffice:  angutar  momentum  is  cheap. 
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persed  sources] .. .might  have  prevented  the  loss  of  essential  services."  (It 
was  the  failure  of  traffic  signals  and  street  lighting  which  "facilitated 
looting,  caused  traffic  accidents,  and  immobilized  law  enforcement.") 

The  analysis  notes  [  : 5—5 1 ]  that  "Although  major  restrictions  affecting 
generation  resources  such  as  nuclear  moratoriums,  fuel  embargoes,  shutdown  of 
all  plants  having  the  same  design  deficiency  and  strikes"  have  not  been  con¬ 
sidered  in  past  utility  reliability  calculations,  they  may  be  very  damaging 
"because  of  the  large  number  of  generating  units  that  could  be  affected  simul¬ 
taneously."  If  such  disruptions  caused  the  expected  outage  rate  to  increase 
from  one  day  per  decade  to  one  week  per  decade,  a  standby  source  with  an  annual 
cost  of  $60/kW  could  well  be  justified,  because  outage  costs  might  well  exceed 
its  break-even  point  of  $ll/kW-h  [id.].  But  for  the  dispersed  sources  to  be 
"most  useful  during  a  supply  emergency,  it  is  essential  that  there  is  a  priori¬ 
ty  load  allocation  scheme  as  well  as  supervisory  control  systems  and  other 
hardware  to  ensure  that  the  system  can,  in  fact,  be  operated  according  to  this 
scheme.  In  the  absence  of  priority  allocation,  essential  loads  might  be  cur¬ 
tailed  while  non-essential  loads  continue  to  be  served.  In  addition,  the  [dis¬ 
persed]  .. .generator  could  easily  be  disconnected  from  the  system  by  its  over¬ 
load,  undervoltage,  or  under frequency  protections."  Individual  operators  of 
dispersed  sources  might  also  need  some  way  to  limit  their  own  loads  to  essen¬ 
tial  uses  in  order  not  to  overload  the  isolated  source;  but  then  idle  capacity 
available  to  the  user  might  not  get  into  the  rest  of  the  grid  in  its  moment  of 
need  [ : 5—52 ]  .  This  implies  still  another  unconsidered  design  requirement  in 
the  control  systems  for  dispersed  renewable  sources.  Although  Systems  Control, 
Inc.  has  a  continuing  DOE  research  project  on  priority  load  allocation  for 
entire  grids,  such  measures  are  very  far  from  realization,  and  virtually  no 
work  has  been  done  on  priority  load  allocation  on  the  scale  on  which  a  small 
renewable  source  might  be  used  and  controlled. 

In  summary:  adequate  means  of  integrating  all  available  renewable  systems 
into  the  electric  grids,  and  other  parts  of  the  energy  system,  are  available’.' 
Further  analysis  and  action  are  urgently  needed,  however,  to  determine  which 
methods  are  best,  whether  end-use  systems  should  be  modified  to  reduce  tota’ 
costs,  and  how  to  design  and  organize  the  dispersed  sources  for  greatest  bene¬ 
fits  to  energy  preparedness.  Otherwise,  as  the  soft  technologies  emerge  into 
widespread  use  with  unexpected  speed,  their  patterns  of  use  may  evolve  so 
haphazardly  that  many  of  their  potential  resilience  benefits  may  be  foregone. 


7.3.  The  state  of  the  art. 
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The  immense  diversity  of  appropriate  renewable  sources  and  hybrid  combina¬ 
tions  of  them,  their  range  of  complexity  and  technical  sophistication,  and  the 
extremely  rapid  pace  of  their  development  make  any  assessment  of  their  techni¬ 
cal  and  economic  status  ephemeral.  An  early  review  [Lovins  1978]  drafted  In 
November  1977  needed  half  its  data  changed  by  March  1978,  and  another  quarter 
had  become  obsolete  by  the  time  the  proofs  arrived  in  May.  This  moving  target, 
however,  is  generally  moving  in  a  favorable  direction — either  lower  real  costs 
or  a  lower  rate  of  real  cost  escalation  than  nonrenewable  compet i tors--so  not 
being  completely  up-to-date  may  just  mean  omitting  recent  good  news. 

7.3.1.  Economic  status  of  soft  technologies  at  the  margin. 

As  Chapter  7.1.1  showed,  economic  comparisons  are  fraught  with  pitfalls. 

It  is  especially  risky  to  compare  data  calculated  by  different  analysts,  be¬ 
cause  they  may  use  different  accounting  conventions  or  degrees  of  conservatism. 
The  assessment  just  mentioned  (Lovins  1978],  for  example,  whose  economic  re¬ 
sults  are  summarized  on  the  following  two  pages,  used  consistent  conventions, 
and  ensured  that  the  conclusions  were  weighted  against  renewables  by  assuming: 

-  no  real  cost  escalation  for  any  source  after  1976  ordering; 

-  generously  low  prices  for  nonrenewable  systems  (Lovins  1978a, 1979a] ; 

-  the  same  high  fixed  charge  rate*  for  both  types  of  systems  (this  dis¬ 
criminates  against  those  with  a  high  ratio  of  capital  to  operating  costs,  and 
allows  no  credit  for  renewables'  shorter  lead  time  and  faster  payback  time 
[Kahn  et  al .  1980]); 

-  no  cheap  designs  (such  as  passive  solar  systems,  solar  ponds,  community- 
scale  or  roof- integrated  collectors,  collectors  made  of  such  materials  as 
plastic  films  or  extrusions,  other  low-technology  designs  and  devices); 

-  for  heating  applications,  an  unrealistically  efficient  heat  pump  (230% 
efficient  on  the  coldest  winter  day)  operated  by  baseload  (rather  than  average 
or  peaking)  electricity. 

Such  multiple  conservatisms  help  to  ensure  that  the  severalfold  price  advantage 
shown  for  the  soft  technologies  over  their  marginal  competitors  is  not  an 
artifact  of  arguable  assumptions  but  a  robust  and  decisive  conclusion — one  on 
which  many  analyses  have  lately  converged  (Stobaugh  &  Yergin  1979;  Southern 
California  Edison  Co.  1980;  Sant  et  al.  1981;  SERI  1981]. 

*This  converts  a  capital  cost  to  an  annual  capital  charge.  The  rate  used — 
12%/y  in  real  terms,  or  ca.  20-24%/y  nominal — means  that  if  a  system  costs 
$1000/kW  to  build,  $120/y  in  capital  cost  must  be  charged  against  the  output 
from  each  kW  of  capacity. 


Table  I  Approximate  marginal  capital  investment  fot  complete  energy  systems  deliver-  Table  I  (Continued) 
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Such  generic  analyses,  though  informative,  cannot  completely  substitute 
for  a  more  "microscopic"  analysis  that  takes  account  of  the  complexities  of 
system  integration.  Several  recent  studies,  for  example,  have  examined  the 
engineering  and  economic  details  of  adding  dispersed  renewable  sources  to  a 
conventional  power  grid.  While  the  shape  of  that  grid  is  determined  by  certain 
unrealistic  assumptions  (notably  that  central  power  stations  are  far  cheaper 
than  they  are  at  the  margin,  and  that  electricity  demand  will  not  decrease  in 
response  to  rising  real  costs),  this  conservatism  makes  the  favorable  findings 
all  the  more  interesting.  The  analyses  [Systems  Control  1 980 , 1 980a , 1980b , 
1980c;  Boardman  et  al ■  1981]  find,  for  example,  that  dispersed  renewable  sour¬ 
ces  of  electricity,  even  if  intermittent,  would  improve  the  system's  generation 
reliability  [1980:5-52],  and  may  add  to  service  reliability  by  protecting  the 
end-user  against  both  grid  and  generation  failures  [  : 5—5 3 ]  .  Wind  turbines 
(studied  only  as  DOE  designs,  200  kW-2.5  MW),  photovoltaics,  diesels,  and  fuel 
cells  "can  provide  an  economic  alternative  to  large-scale  central  generation 
[assumed  to  cost  much  less  than  actual  marginal  cost]  if  their  projected  cost 
goals  can  be  met."  [ 1980 : Summ: 3]  (Those  goals  have  already  been  exceeded  by 
small  wind  machines  [Lovins  1978],  and  are  likely  to  be  met  ahead  of  schedule, 
as  noted  below,  for  photovoltaics.)  Roughly  half  the  distributed  sources'  eco¬ 
nomic  advantage  comes  from  their  capacity  savings  [Diesendorf  1981],  half  from 
their  energy  savings.  The  total  cost  savings  is  not  very  sensitive  to  the 
details  of  the  utility's  load  or  generation  mix,  but  declines  as  the  renewable 
fraction  increases*  (if  the  economic  responses  which  would  reduce  total  demand 
and  change  the  shape  of  the  grid  [Diesendorf  1981]  are  assumed  not  to  operate). 

Spreading  the  renewables,  e.g.  wind  machines,  over  a  larger  geographic 
region,  or  integrating  different  sources,  e.g.  wind  with  photovoltaics,  im¬ 
proves  their  reliability  and  economics  [System  Control  1980:3-4;  Diesendorf 
1981;  Kahn  1978].  Year-to-year  variations  in  solar  and  wind  energy  are  "less 
than  the  variation  in  water  flow  of  many  hydroelectric  projects"  and  can  be 
handled  by  similar  planning  methods.  Dispersed  sources,  if  reliable,  can  save 
transmission  and  distribution  costs  and  losses  (amounting  to  about  a  tenth  of 
the  generation  savings)  [id.:3-4].  Although  analysis  of  renewable  systems  with 


*A  recent  cal  1  a t i on  [Lee  &  Yamayee  1980]  suggests  that  under  pessimistic 
assumptions,  extra  spinning  reserve  requirements  may  limit  the  economic  use  of 
some  renewables  to  a  few  percent  of  the  total  load  [Systems  Control  1980]. 

But  since  the  assumed  methodology  appears  to  treat  renewable  and  nonrenewable 
generation  asymmetrically  (the  latter  should  also  incur  such  a  penalty,  espec¬ 
ially  since  it  can  fail  in  much  larger  blocks)  and  to  use  unrealistic  cost 
and  outage  data  for  nonrenewable  sources,  this  conclusion  cannot  be  considered 
reliable.  Also,  1  kW  of  system  storage  "can  provide  up  to  2  kW  of  spinning- 
reserve  and  load-following  capability"  [Systems  Control  1980c: 14],  potentially 
providing  a  cheaper  solution.  Systems  Control  is  checking  this  further. 
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dispersed  storage  is  complex,  system  economics  do  not  seem  very  sensitive  to 
whether  or  where  storage  is  provided,  and  phot ovol t a i cs  in  particular  do  not 
require  on-site  storage  for  favorable  economics  [Systems  Control  1980c]  as  some 
critics  have  claimed. 

Such  detailed  assessments  offer  useful  insights  into  system  design.  But 
their  complexity  and  opacity  may  obscure  the  broader  relationship  between  the 
marginal  prices  of  energy  services  from  soft  and  hard  technologies.  The  tables 
on  the  following  three  pages  seek  to  illuminate  that  relationship  in  each  of 
four  service  categories — low-  and  high-temperature  heat,  vehicular  liquid 
fuels,  and  electricity — by  assembling  a  list  of  documented  price  calculations 
for  a  wide  variety  of  sources.  All  prices  are  normalized  to  the  same  units 
(constant  1980  dollars  per  million  BTU  or,  approximately,  per  giga joule)  and  to 
the  same  fixed  charge  rate  ( 10%/ y  in  real  terms,  or  about  20+%/y  in  nominal  or 
current-dol lar  terms).  Although  no  such  comparison  can  be  definitive,  that 
provided  here  is  designed  to  show  the  main  components  that  determine  price — 
like  the  tables  on  pp.  230-231  [Lovins  1978]  but  using  more  up-to-date  data. 

The  first  table,  for  example,  shows  that  low-temperature  heat  provided  by 
burning  today's  fuels  in  a  70%-ef f icient  furnace  (better  than  most)  will  cost, 
with  the  very  temporary  exception  of  natural  gas  pending  its  decontrol,  around 
$15/1 0^  BTU,  or  about  twice  as  much  as  [subsidized]  average  1980  electri¬ 
city  used  in  an  extremely  efficient  heat  pump.  Synthetic  gas  from  coal  is 
no  better;  marginal  electricity  is  about  the  same  or  worse — $25/10^  BTU  in 
resistance  heaters,  $10  with  the  same  super-efficient  heat  pump.  In  contrast, 
efficiency  improvements  cost  typically  $0-3/10^  BTU  saved  (maximum  $5  among 
the  measures  shown,  which  should  keep  the  nation  well  occupied  for  the  next 
decade  or  two).  Passive  solar  measures  are  similarly  cheap.  With  careful 
shopping,  active  solar  heat,  even  on  a  single-house  scale,  is  in  the  $8-10/ 

10^  BTU  range,  competing  with  deregulated  fuels  and  power  today.  The  real 
price  of  conventional  packaged  active  systems  is  widely  expected  to  continue 
falling  by  2-3%/y  [SERI  1981:11:175],  and  some  simplified  designs  shown, 
whether  do-it-yourself  or  commercial,  have  already  dropped  prices  even  faster, 
empirically  achieving  about  $4-6/10^  BTU  even  with  commercial  fabrication. 

The  empirical  cost  ($9)  of  heat  from  a  municipally  operated  solar  pond  in  Ohio 
(a  technology  described  below)  also  competes  with  oil  or  electric-resistance 
heat  at  today's  prices,  and  competes  even  with  electric  or  gas  heat  pumps  at 
marginal  prices.  Community  solar  heating  systems  [Gleason  1981,198b;  Taylor  & 
Taylor  1981],  using  conventional  collectors  or  solar  ponds,  can  drop  heat 
prices  down  into  the  range  of  passive  solar  or  of  the  costlier  efficiency 
improvements — about  $4-6/ 10^  BTU.  For  this  application,  then,  presently 
available  renewable  sources  are  the  best  buy  after  efficiency  improvements. 


in  various  final  forms, 


Illustrative  delivered  prices  (1980  $)  for  energy  in  various  final  forms, 

assuming  a  uniform  10%/y 

real  fixed  charge  rate. 

technology 

remarks 

reference  S/IO^BTU 

Heat  <100“C  < <2 1 2 ** F)  (35% 

of  U.S.  delivered  energy 

needs)  (excludes  tax 

cred  its 

unless  otherwise  noted)  . 

10/80  pre-decontrol  gas  \ 

subsidized  fuel  &  power 

[SERI  1981:11:96) 

4.0 

#2  htg .  oil  @  $1 .10/gal  l 

prices  for  comparison; 

[Green  1980] 

13.7 

propane  @  80^/gal  / 

70%-eff.  free  furnace 

[Green  1980] 

13.4 

el.  <a  5.5±/kW-h 

free  resistance  heaters 

16.1 

el.  @  5.5*/kW-h 

$250/kWe  250%-e f f i c  ient 

6.8 

heat  pump,  1%  O&M 

marginal  syngas  (Lurgi 

70%-eff.  free  furnace 

[ Congr . Res . Serv. 

15.0 

methanation  @  $36/bbl 

$300/kWt  input,  130%- 

1981;  T&D  from 

9.0 

oil  price  &  50%  equity) 

efficient  heat  pump 

Am. Gas  Assn.  1977 

[Ross  6  Williams  1981: 

with  GNP  deflator] 

306] ,  2%  O&M 

marginal  nuclear  elec- 

free  resistance  heaters 

see  el.  table  below 

24.7 

tricity  @  8.4^/kW-h 

el.  heat  pump  as  above 

II  II  II  II 

10.3 

thermal  retrofits: 

3%/y  real  discount  rate, 

[SERI  1981:11] 

direct-fueled  houses 

10-y  time  horizon 

saving  >50%  of  heat 

[ : 12-13] 

2.7 

saving  >75%  of  heat 

II 

5.0 

el.-htd.  houses 

saving  >50%  of  heat 

II 

5.0 

commercial  bldgs. 

saving  >35%  of  h&c 

1:70] 

1 .3-2.2 

new  houses  saving  >90% 

Leger,  Phelps,  etc. 

[Leger  &  Dutt  1979; 

<0 

(see  text  pp .  183-4) 

Sh ick .Shurcl if f  1980] 

residential  solar  retrofit 

[SERI  1981:11:94,204 

-5] 

passive 

"best  buys" 

II 

1.5-2. 2 

"average"  (DIY  &  Solar  I) 

II 

3. 5-7. 8 

act ive 

"best  buys" 

II 

8.2 

"average"  (DIY  &  Solar  I) 

It 

9.5 

1980  typical  commercial 

no  tax  credit 

[: 186-7]  9.4-32.5 

packaged  solar  water  ht. 

40%  tax  credit 

"  5 

.6-20.4 

1990  ditto,  expected 

no  tax  credit 

[ :  186-7 ,  175]  5 

.0-25.5 

1990  expected  gas  &  oil 

75%-eff.  furnace,  low  prices  [  :  1 87 ]  12 

.9-25.1 

ca.1982  Teagan  solar  w.h. 

simple  design 

[Popular  Sci. 1981a] 

ca.  6-7 

1980  breadbox  water  ht. 

batch;  10-y  lifetime 

[Green  1980;  see 

2. 2-6. 2 

also  Shapiro  1980] 

1978  site-assembled  act- 

(see  also  SERI  1981: 

[id.;  Worcester  4 

.1-11.4 

ive-solar  air  system 

11:172;  Godolphin  1981] 

Poly.  1978] 

1990-2000  low-cost-col- 

average  installed  h.w. 

[ : 177] 

5.3 

lector  program  goals 

system 

inflatable  greenhouse 

10-y  horizon,  8^/kW-h  fan 

[Solar  Flashes  1980} 

ca.O  .6 

wood  @  $70-90/cord 

20  MMBTU/cord ,  50%  eff. 

[Green  1980] 

7. 0-9.0 

solar  pond  (Miamisburg, 

observed  cost 

[Soft  En.  Notes 

9.2 

Ohio  muni,  operation) 

same  if  it  were  bigger 

4(1) :18-i0  (1^81)  ] 

8.0 

community  solar  systems 

flat-plate 

[Schurr  et  al  . 

3. 8-6. 4 

concentrator 

1979  :ChTITl 

5.1 
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in  various  final  forms, 


Illustrative  delivered  prices  (1980  $)  for  energy 
assuming  a  uniform  10%/y  real  fixed  charge  rate. 

technology _ remarks _ reference  S/IO^BTU 

Heat  >100°C  (23%  of  U.S.  delivered  energy  needs)  (all  tax  credits  excluded 
except  subsidies  to  nonrenewable  sources). 


marginal  el.  (8.4^/kW-h) 
$40/bbl  residual  oil 
syngas  as  above 
manure  biogas 
gas  from  $30/odt  wood 
(retrofit  gasifier) 
same,  $20/oven  dry  ton  . 
30'dia.  parabolic  dish 
(new  materials  cost) 

30 0° C  Winston,  44%  eff., 
incl.  storage  (50^/GJ) 
1980  handmade  troughs, 
incl.  storage  ($1/GJ) 
mass-prod' n  goals 


Sandia  1985  projection 
mass-produced  Fresnels, 
$28-57/m2  ,  63%  eff. , 
incl.  storage  ($1/GJ) 


free  resistance  heaters 
]j80%-ef f icient  free  boiler 

Jl  2%  O&M 

500  ft3  active  vol. 

30%/y  nominal  fixed 
charge  rate 
different  assumptions 
Doug  Wood  (Fox  Is.  WA) 
(av.US  cond'ns  50%  bette 
180  W/m2  insolation, 

$190/ m2  inst'd,  2%0&M 
$45/ f t2 ,  60%  eff. 

in  New  Mexico/New  Hampsh 
conservative  (same  range) 
expected  "  " 

opt imi Stic  "  " 

<315°C  ( <600° F) 

180  W/m2  insolation, 
install 'n  &  plumbing 
$60/m2 ,  2%  O&M 


see  el.  table  below 

24.7 

[OTA  1981:99] 

8.7 
12.0 

7.8 

[OTA  1980:11:138] 

3. 4-3. 7 

[SERI  1979:1:29) 

3.8 

[Soft  En  . Notes 

2.2 

)  2:97  (Dec. ’79)] 
[Grimmer  &  Herr 

9.8 

1977] 

[SERI  1981:11:623, 
re  630] 

6.4-12.5 

[ id . :634) 

3. 7-6. 9 

II 

3. 2-5. 6 

II 

2. 3-3. 8 

[ En .  Insider  '80a] 

10.0 

[Ross  &  Williams 

3. 6-4. 5 

1981:331;  OTA  1978] 


Vehicular  liquid  fuels  (34%  of  U.S.  delivered  energy  needs  (all  tax  credits  ex¬ 
cluded  except  subsidies  to  nonrenewables;  all  BTUs  counted  as  equal  in  value, 
which  underestimates  fuel  alcohols*  value  in  appropriate  blends  or  engines). 


1980  taxed  reg.  gasoline  $1 .35/U.S .gal . 
synfuel  (EDS  process,  $4/bbl  refining,  mar- 
$36/bbl  oil,  50%  equity)  keting,  &  distribution 
synfuel  (H-coal,  ditto)  (almost  certainly  too 
synfuel  (Sasol  II,  ditto)  low  an  estimate) 


11.2 

[ Congr . Res .Serv . 1981 ]  10.0 


id  .  ] 
id  .  ] 


10.9 

22.7 


gasoline  saving 


efficient  road  vehicles  see  text  pp.  186-7 


<3.5 


free,  half-wet  sawdust 


[Tatom  et  ai.  1976]  1.0-1  .4 
[Green  1980)  3. 9-8.1 
[Benemann  1977]  6.0 


no  crop  or  labor  cost 


enzymatic  process 
(estimated  from  lab.) 
hybrid  processes 


[Amer .Homegrown  Fuel]  5.7 
[Green  1980)  6.9-12.6 


portable  pyrolyzer 
methanol  from  muni,  wastes 
pyrolysis  "oil"  from 
municipal  wastes 
homemade  ethanol 
pyrolysis  "oil"  from 
wood  &  cellulosic  wastes 
ethanol  from  same 
@  $1 1 .25/odt 
methanol  from  Canadian 
forestry  wastes 
ethanol  from  grains 
ditto 

ethanol  from  cellulosics 
methanol  from  $10-30/odt 
wood,  oxygen-gasified 
ethanol  from  1 ignocel lulose  Emert  process,  projected  [SERI  1981:11:581)  ca.16 

(other  processses  in  development  may  yield  ca.  6-10) 
methanol  from  all  sources  mostly  from  wood  [SERI  1981:11:591)  8.7-22.8 


[Pye  &  Humphrey 
1979] 

[interGroup  1978] 


ca. 10-11 


ca. 10-13 


convent'l  Ig-scale  dist'n  [OTA  1980:11:165]  11.3-15.7 
ditto  [SERI  1980a:84)  15.8 
ditto,  projected  [OTA  1980:11:173]  12.2-17.0 

{ id . : 140]  11.5-22.8 
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Illustrative  delivered  prices  (1980  $)  for  energy  in  various  final  forms, 
assuming  a  uniform  10%/y  real  fixed  charge  rate. 

technology  _ remarks _ reference  S/IO^BTU 


Electricity  (82  of  U.S.  delivered  energy  needsHexctudes  all  tax  credits  except 
subsidies  to  nonrenewables). 


1980  av. price  (5.5|/kW-h) 

subsidized 

[Lovins  1981a] 

16.1 

NYC  taxed  av.  price  (15.31)  (peak  rate  24. 9|) 

[Russell  1981] 

44.8 

marginal  price  from 

subsidized;  GNP  deflator 

[id.;  Bowring  1980] 

24.6 

LWR  commissioned  1988 

applied  to  earlier  cal- 

[Lovins  1977,1978a, 

(8.4|/kW-h) 

culation  (at  12%/y  real 

1979a] 

fixed  charge  rate) 

same,  recalculated  (7.6 

updated  data  on  reactor, 

[Komanoff  1981] 

22.2- 

1/kW-h  with  1979  reactor 

decommissioning,  fuel- 

(10%/y  real  fixed 

25  .2 

ordering  or  ca.  8.6| 

cycle,  and  O&M  costs; 

charge  rate  throughout) 

with  1981  ordering) 

updated  grid  &  fuel-cy- 

[Bechtel  data:  Lovins 

using  same  methodology 

cle-facility  costs;  GNP 

1979a:nn20 ,21 ] 

[Lovins  1977, 1978a, 1979a] 

deflator  used  1979-80. 

electricity  savings 

typically  0-1.5l/kW-h 

[Appendix  A;  SERI 

0-4.4 

(see  text,  pp.  185,188) 

1981] 

microhydro  (2-8|/kW-h) 

highly  site-specific 

[SERI  1981:11:958]  5.9 

-23.4 

homemade  solar-thermal- 

Doug  Wood  (Fox  Is.  WA) 

[Soft  En .  Notes 

9.3 

electric  ( 30 1  dish) 

(3 .2|/kW-h)(av.  US  con- 

2:97  (Dec. 1979)] 

(new  materials  cost  only) 

1  ditions  are  50%  better) 

high-tech  solar-thermal- 

$85/m2  heliostats  [SERI  1981:11:941-3]  21. 

7 

electric  (power  tower) 

($96  falling  to  $68  is 

in  Phoenix  (7.4|/kW-h) 

expected  in  mass  prodn.) 

[Solar  Thermal  Rpt.'81 

] 

same,  dish  design  (ca. 

1985,  no  cogeneration 

[SERI  1981:11:943] 

16|/kW-h) 

credit 

46.9 

same,  1990  projection 

25  ,000/ y  prodn.  (5.2|) 

Ud.] 

15.2 

10-kWp  Millville  wind 

mass  prodn.  (5.1|/kW-h) 

[ id  . :  191  ] 

14.7 

machines,  privately 

+  innov.  installn.  (4.1|) 

12.0 

owned,  13  mph  @  40' , 

+  95%  learn'g  curve  (3.4|) 

10.1 

1 X  O&M  added,  no  grid 

(all  based  on  empirical 

costs,  free  land 

installed  prices) 

2.5-MWp  Boeing  Mod  II 

projected  lOOth-unit  price 

s  [ id  . : 935—39 ] 

13.0 

high-tech  wind  machine, 

with  GNP  deflator  to  1980$ 

+  $85/kWp  land  ($3000/ 

($809/kWp  net  installed  ■* 

acre  @  5-dia.  spacing) , 

10%  contingency),  $100/kWp 

0,3  capacity  factor, 

T&D  cost,  4%  T&D  losses 

O&M  $15  ,00/y 

(delivers  @  4.46|/kW-h) 

community  photovoltaic  $15/Wp  cells  18%  eff.  @  [Ross  &  Williams  25.1- 

cogeneration  system,  28’C;  $80-135/m2;  1981:170-9]  28.3 

municipal-util,  owned,  diesel  backup,  1976-80 

counting  heat  credit  GNP  deflator  (6.4-7.2i) 

best  present  photovoltaic  $7/Wp,  double  for  balance  [Henry  Kelly,  pers.  5.3- 
components  if  assembled  of  system  incl.  3x  Winston  cotnmun.  1981]  66.5 

into  cogen.  system  with  concentrator,  Phoenix- 
waste  heat  worth  $13.7/  Seattle  cap.  factors 
MMBTU  (same  as  $1. 10/gal  (0.26-0.13),  4  kWt  waste 
oil  in  60%-eff.  furnace)  heat/kWe:  thus  1 .8-22 . 7i/kWe-h 

1986  silicon  cells  (DOE  system  $1.6-2.2/Wp,  util.  [Russell  1981;  DOE  17.3- 
goal)  or  ca.  1983  Ametek  buyback  @  5051  of  av.  price  1980a;  JPL  1980;  23.7 

est.,  no  cogeneration  (delivers  @  5 . 9-8 . 1 i/kW-h)  Ametek  1979] 

1990  photovoltaics  (111)  Southern  Ca.  Edison  est.  [Ca. Energy  Comm.  32.2 

1980a: 176] 

Martin-Marietta  PV/Fresnel  1981  technol.  (?  50  MWe  order  [Maycock  1981:42]  17.6 


The  second  table  shows  a  similar  result.  Synthetic  gas  burned  in  an  in¬ 
dustrial  boiler  to  provide  process  heat  will  deliver  even  costlier  heat  ($12/ 

106  BTU)  than  residual  oil  at  market  prices  does  now  ($9),  though  still 
cheaper  than  marginal  electricity  ($25).  Even  expensive  wood  wastes  can  deliv¬ 
er  the  same  clean  heat  via  commercially  available  gasifiers  [OTA  1980:11:154-5; 
SERI  1979]  for  $3-4.  Simple  solar  concentrators  at  temperatures  adequate  for 
nearly  all  industries  other  than  ceramics/bricks/glass  and  primary  metals 
(which  need  higher  concentrations  or  indirect  forms  of  solar  energy  [Lovins  et 
al .  1981:82])  now  deliver  heat  at  prices  competitive  with  syngas  or  OPEC  oil  or 
both*.  Homemade  versions  (costing  only  materials,  not  labor)  can  achieve  $2  in 
cloudy  areas.  As  the  prototype  concentrators  now  on  the  market  are  replaced  by 
mass-production  models  [Solar  Thermal  Report  1981b],  prices  over  the  next  few 
years  should  fall  to  about  $3-6 — well  below  present  oil  prices — through  normal 
scaling-up  of  what  are  now  model-shop  operations.  (if  coal  cost  only  half  as 
much  per  BTU  as  OPEC  oil  does  today,  a  clean  coal  boiler  could  probably  not 
compete  with  most  mass-produced  solar  concentrators.  Average  U.S.  coal  pric¬ 
es — for  big  orders  in  areas  with  a  coal-delivery  infrastructure — are  somewhat 
below  that  level,  but  long-term  coal  prices  will  probably  seek  opportunity-cost 
levels  against  world  oil.) 

Many  renewable  liquid  fuels — especially  those  from  thermochemical  proces¬ 
ses  fed  with  farm  or  forestry  wastes — are  likewise  cheaper  than  coal  synthetics. 
This  is  partly  because  woody  materials  have  much  more  favorable  chemical  reac¬ 
tion  kinetics  than  coal:  they  break  down  faster,  at  lower  temperatures,  and 
with  little  or  no  tar  formation.  Both  the  energy  and  the  capital  requirements 
are  accordingly  lower,  and  the  yields  generally  higher,  than  for  equivalent 
coal  liquefaction.  Some  renewable  liquids,  especially  those  emphasized  by 
current  policy,  are  slightly  costlier  per  BTU  if  inefficiently  produced  or  if 
made  from  specially  grown  crops,  though  the  comparison  shown  does  not  count  the 
credit  due  to  fuel  alcohols  for  their  cleaner  and  more  efficient  burning  prop¬ 
erties.  Methanol  can  be  especially  efficient  in  a  high-compression  engine, 
such  as  a  spark-ignited  diesel.  A  methanol-powered  cross-country  flight  by 
former  Astronaut  Gordon  Cooper  and  by  President  Reagan's  former  pilot  [Cooper  6 
Paynter  1981]  not  only  dramatized  methanol's  potential  for  greatly  improving 
the  airlines'  parlous  finances;  it  also  demonstrated  that  in  piston  engines 
above  about  10,000',  methanol  is  more  powerful  per  gallon  than  aviation  fuel. 

Finally,  the  table  on  p.  236  shows  that  a  wide  range  of  renewable  sources 

— microhydro,  wind,  simple  solar-thermal  engines,  even  some  photovoltaic  cogen- 

eration  systems — can  deliver  electricity  at  about  2-6i/kW-h.  This  competes 

*An  Israeli  entrepreneur  is  building  5000  m^  of  parabolic  troughs  in 
Israel  in  1981,  and  plans  more  in  the  U.S.  in  1982;  he  offers  to  supply  up  to 
a  conservative  30%  of  industrial  steam  loads  10%  cheaper  than  a  factory  now 
pays,  and  he  pockets  the  difference.  [Avram  Kalisky,  pers.  comm.,  1.81]. 
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handily  with  the  marginal  delivered  price  from  newly  ordered  central  power  sta¬ 
tions  (ca.  8i).  Many  of  the  presently  available  renewables  also  compete  with 
the  present  average  (rolled-in)  price  seen  by  the  consumer,  or  with  the  roughly 
equivalent  fuel  and  operating  cost  of  running  oil-fired  stations  (5-7+t).  Vir¬ 
tually  any  of  the  renewables  would  be  attractive  today  in  high-price  areas, 
such  as  New  York  City  (15±  regular  taxed  price  and  254  at  peak  periods  in  late 
1980),  Alaskan  villages  and  remote  military  bases  (typically  upwards  of  40i/kW- 
h),  and  rural  areas  of  developing  countries  (30-90i/kW-h) .  The  table  shows 
that  the  smaller  technologies  tend  to  deliver  cheaper  electricity  than  the  cen¬ 
tralized  ones  (Chapter  5),  and  illustrates  the  diversity  of  options.  Photovol¬ 
taic  prices,  as  noted  below,  are  dropping  so  quickly  that  DOE  now  expects  them, 
even  in  central-station  applications,  to  compete  with  average  grid  prices  by 
1986  using  demonstrated  technologies  [Adler  1981;  Maycock  1981;  Russell  1981); 
but  microhydro  and  wind,  and  perhaps  other  renewable  sources,  have  al ready 
achieved  this  with  hardware  now  on  the  market.  The  same  cannot  be  said  of  the 

centralized  solar-electric  systems multi-megawatt  wind  machines,  power  towers, 

ocean-thermal-elect ric  conversion,  centralized  biomass  plantations  to  fuel  ther¬ 
mal  power  plants,  solar  satellites,  etc. — to  which  much  of  the  Federal  solar 
budget  has  been  devoted  for  the  past  decad  .  There  is  not  even  a  credible  pros- 
spect  of  ever  achieving  such  compet it iveness  via  the  fusion  program,  the 
second-b iggest  component  of  DOE's  R&D  budget  (with  about  half  as  much  FY1982 
funding  as  fission  and  twice  as  much  as  all  renewables  conbined). 

7.3.2.  Selected  technical  developments. 

The  state  of  the  art  in  inherently  resilient  energy  sources  has  been  treated  in 
detail  in  recent  literature  for  lay  audiences  [Energy  &  Defense  Project  1980), 
for  scientists  [Sorensen  1979;  Lovins  1978],  and  for  policy-makers  [SERI 
1981;  Soft  Energy  Notes).  It  is  not  possible  in  a  document  of  this  length  to 
do  justice  to  those  fundamentals.  Rather,  in  this  section  we  shall  highlight 
some  recent  technological  advances  which  seem  especially  promising  for  making 
the  U.S.  energy  system  less  vulnerable  and  which  have  not  been  described  in 
earl ier  sect  ions . 

Heat .  Passive  solar  techniques  are  now  known  to  be  the  best  buy  (after, 
and  in  conbination  with,  efficiency  improvements)  for  both  new  buildings  and 
retrofits.  Sophisticated  design  tools  [DOE  1980]  and  packaged  design  kits 
tailored  to  particular  climates  [California  Energy  Commission  1980]  have  become 
available.  One  can  now  accurately  simulate  and  optimize  the  performance  of  any 
conbination  of  passive  elements  in  any  climate  on  a  standard  hand  calculator 
(thanks  largely  to  a  Los  Alamos  effort  now  threatened  with  discontinuation). 

In  general,  such  techniques  have  turned  out  to  be  much  simpler  and  more  effec¬ 
tive  than  expected.  Rule-of-thunb  techniques  have  developed  which  make  it  hard 
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to  go  wrong.  Annual  national  and  international  passive-solar  conferences  have 
refined  and  propagated  these  techniques  with  remarkable  speed.  Successful  pas¬ 
sive  solar  houses  are  now  being  built  or  retrofitted  [Reif  1981]  even  in  the 
least  favorable  solar  climates  [e.g.  Maine  Office  of  Energy  Resources  1980; 
Woychik  1981 ] . 

New  materials  with  very  unusual  properties  are  becoming  available  for  both 
passive  and  active  solar  use.  For  example,  an  adhesive  selective  surface  sel¬ 
ling  for  $1.2-1.9/ft2  (SunSponge®)  boosts  the  performance  of  Trombe  walls 
(glazed  solar-absorbing  masonry  walls)  by  about  a  third,  but  costs  less  than 
the  equivalent  level  of  movable  insulation  (ca.  R-9  to  R-12)  .  Transparent  in¬ 
sulating  and  heat-reflecting  materials  (including  Heat  Mirror®)  are  now  in 
commercial  production.  Some  new  plastic-film  glazing  materials,  such  as  3M's 
Flexigard®,  transmit  better  than  window  glass  at  visible  wavelengths,  are  near¬ 
ly  opaque  in  the  infrared,  and  show  no  signs  of  degradation  after  12  years' 
weathering  in  bright  sunlight  [King  1979].  Tough,  highly  durable  plastic  films 
have  been  proposed  by  T.B.  Taylor  and  developed  by  Brookhaven  National  Labora¬ 
tory  as  materials  for  active  solar  collectors  at  least  ten  times  cheaper  than 
conventional  ones.  Such  collectors  have  for  several  years  been  sold  in  Swit¬ 
zerland  [Ener-Nat  1979],  and  could  easily  be  site-assembled  just  as  plastic- 
film  greenhouses  are  now.  Stockpiling  appropriate  films  and  instructions  could 
indeed  be  an  important  element  of  any  solar  mobilization. 

So  diverse  are  solar  collector  designs  that  it  is  not  yet  clear  whether 
flat-plate  or  concentrating  collectors  are  superior  for  low-temperature  appli¬ 
cations.  OTA  [1978]  found  that  the  cheapest  collector  on  the  1977  market 
(other  than  Tollable  plastic  mats  and  other  unconventional  designs,  some  of 
which  are  quite  effective)  was  a  concentrating  parabolic  trough.  Very  simple 
automatic  tracking  mechanisms  have  been  developed.  They  can  be  quite  reliable, 
as  attested  by  the  performance  of  military  and  airport  radar  trackers.  Robert 
Carlson  of  Sandia,  who  has  sold  thousands  of  sets  of  plans  for  a  homemade  con¬ 
centrator  of  the  type  used  on  his  own  house,  argues  with  some  justification 
that  even  in  a  climate  as  cloudy  as  Boston,  the  extra  efficiency  of  a  concen¬ 
trating  collector  when  exposed  to  direct  sunlight  can  more  than  make  up  for  its 
inability  to  capture  the  diffuse  light  which  a  flat  plate  can,  since  much  of 
the  diffuse  light  arrives  at  too  low  an  intensity  to  reach  the  operating  thres¬ 
hold  of  a  conventional  flat-plate  collector.  This  argument  has  particular 
merit  for  photovoltaic  cogeneration  systems  (below). 

A  counterargument,  however,  is  that  in  a  cloudy  climate,  "conventional" 
flat  plates — those  with  a  flat-black  absorbing  surface — are  the  wrong  choice. 

A  "selective"  surface,  which  absorbs  visible  wavelengths  well  but  radiates 
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infrared  badly,  is  far  preferable.  A  selectivity  ratio  (visible  absorptivity  : 
infrared  emissivity)  of  about  5  can  be  obtained  simply  by  brushing  a  lampblack- 
water  slurry  on  a  metal  absorber  plate  and  letting  it  dry  to  a  thickness  which 
removes  the  metallic  luster  but  is  still  gray,  not  black.  A  selectivity  of  ca . 
8-10  can  be  achieved  by  many  kinds  of  electrochemical  coating  processes  and  some 
special  paints.  Alternatively,  for  $3/m2J  a  selectivity-8  foil  can  be  ap¬ 
plied,  e.g.  by  stretching  it  over  a  slightly  convex  collector.  This  simple  mod¬ 
ification  produces  remarkable  results  [Raetz  1979,1979a].  Because  the  diffusely 
scattered  light  on  a  cloudy  day,  although  somewhat  reduced  in  intensity,  is 
still  energy  of  extremely  high  quality — its  effective  color  temperature  is  over 
5000°F — a  selective  surface,  suitably  insulated,  will  attain  very  high  equilib¬ 
rium  temperatures .  Thus  Raetz' s  selectivity-8  single-glazed  collector  heats 
domestic  water  by  a  highly  satisfactory  54“F  with  45%  efficiency  on  a  cloudy 
winter  day  in  Hanburg  (total  insolation  200  W/m^,  or  one-fifth  of  the  full 
summer-sunlight  level),  (insolation  of  300  W/m^  raises  the  efficiency  to 
57%. )  Higher  selectivity  makes  the  collector  even  less  sensitive  to  cloudiness. 
A  selectivity  in  excess  of  50  can  be  obtained  by  sputtering  thin  films,  using 
well-established  high-vacuum  techniques  similar  to  but  less  demanding  than  those 
used  in  coating  optical  lenses.  A  selectivity-50  surface  in  a  hard  vacuum  will 
serve  a  process  heat  load  at  500-600°C  (ca.  930-1 llO^F)  on  a  cloudy  winter  day 
in  Juneau.  If  the  liquid-metal  coolant  in  such  an  absorber  should  stop  flowing, 
the  metal  absorber  plate  would  melt. 

In  contrast,  only  direct  sunl ight  can  be  used  to  operate  conventional  con¬ 
centrating  dishes,  such  as  the  23' -diameter  General  Electric  prototypes  which 
recently  supplied  750°F  (450°C)  at  71%  efficiency  [Sunworld  1980].  (That  temp¬ 
erature  is  adequate  to  supply  essentially  all  process  heat  needs  in  the  food, 
paper,  and  chemical  industry,  plus  most  of  the  needs  of  oil  refining.)  Point- 
focus  systems  for  loads  up  to  about  1500°F  are  beginning  to  enter  the  market. 
Power  Kinetics  Corp.  (Troy  NY)  offers  a  $37,000,  80-m2,  59-kWtp,  74-79%-ef- 
ficient  dish  with  calculated  Northeast  payback  times  of  3-10  y  against  oil 
(Barden  1981],  similar  to  the  "conservative"  SERI  mass-production  goal  on  p. 

235.  Another  dish  has  heated  gas  to  2200°F  (1204°C)  steadily,  and  to  2600°F 
(1427°C)  maximum  [Solar  Thermal  Report  1981a].  Commercial  line-focus  systems, 
of  which  over  100,000  m^  were  made  in  the  U.S.  in  1980,  go  up  to  ca.  500“F. 
Central  receivers  with  fields  of  tracking  mirrors  (heliostats)  are  under  devel¬ 
opment  (an  Italian  firm  sells  small  fields  [OTA  1978])  and  can  achieve  tempera¬ 
tures  adequate  to  vaporize  any  material.  Some  potentially  very  cheap  concentra¬ 
tors  substituting  micropol ished  reflective  plastic  films  for  metal  are  evolving 
at  SERI,  Lawrence  Livermore  Laboratory,  and  elsewhere.  Cheap  dish  concentrators 
have  also  been  homemade  [Soft  Energy  Notes  2:97  (1979)],  including  one 
which,  in  the  Olympic  Peninsula,  provides  40  kW  of  steam  at  a  new-mater ial s  cost 
less  than  half  the  cost  of  heat  from  burning  1981  CPEC  oil  at  80%  efficiency. 
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Among  the  most  rapidly  emerging  solar  technologies  during  1980-81  is  the 
solar  pond,  a  passive  device  for  cheapLy  supplying  heat  year-round,  day  and 
night.  Although  there  are  several  types  of  solar  pond,  the  most  common  is  a 
hole  in  the  ground  with  an  impervious  liner,  filled  with  concentrated  brine — 
various  kinds  of  salts  can  be  used — and  preferably  with  a  darkened  bottom. 

Both  direct  and  diffuse  solar  radiation  heat  up  the  bottom  of  the  pond,  but 
because  the  hotter  water  there  dissolves  more  salt  and  is  thus  denser,  convec¬ 
tive  heat  transfer  to  the  surface  is  suppressed.  (With  some  geometries,  the 
salt  can  also  form  a  self-stabilizing  gradient  of  optical  bending  power  which 
helps  to  concentrate  light  on  the  bottom.)  A  layer  of  fresh  water  on  top, 
which  stays  fairly  well  segregated,  acts  as  a  transparent  insulator.  Other 
forms  of  translucent  insulation  can  also  be  added.  A  simple  heat  exchanger, 
such  as  some  pipes  near  the  bottom,  can  extract  heat  at  nearly  the  boiling 
point:  solar  ponds  in  sunny  areas  can  boil  by  late  summer.  The  large  thermal 
mass  of  the  pond  provides  built-in  heat  storage,  although  it  may  take  some 
months  to  come  up  to  its  full  working  tenperature .  Good  ponds  are  20-30% 
efficient  in  converting  total  insolation  to  heat.  They  may  cost  $5-10/m2 
if  salt  is  available  on-site,  as  near  many  mines  and  factories;  $30/m2  or 

more  if  the  hole,  liner,  and  salt  must  be  specially  provided.  | 

Solar  ponds  were  originally  expected  to  work  only  in  desert  climates,  but 
the  successful  operation  of  a  2000-m2  pond  by  the  City  of  Miamisburg,  Ohio 
since  1978  has  dispelled  that  notion.  Even  with  ice  on  the  surface,  the  bottom 
temperature  in  the  cold  spell  of  February  1978  was  still  83“F  (28°C).  Total 
cost,  mostly  salt  (1100  tons)  and  liner,  was  $34.4/m2,  maintenance  cost  is 
very  small,  and  the  delivered  heat  price,  as  noted  on  p.  234,  is  $9.2/10^ 

BTU,  equivalent  to  75±/gal  oil  in  a  70%-ef f icient  free  furnace  or  to  3.1±/kW-h 
electricity  [Wittenberg  &  Harris  1980;  Nielsen  1980).  Solar  pond  research  be¬ 
ing  pursued  by  the  Jet  Propulsion  Laboratory,  Los  Alamos,  California  Energy 
Commission,  Southern  California  Edison  Co.,  and  others  should  lead  in  the  next 
few  years  to  the  sort  of  "cookbook"  understanding  of  pond  design  already  ob¬ 
tained  for  passive  solar  techniques.  Solar  ponds  are  a  robust,  nearly  invul¬ 
nerable  heat  source:  even  an  event  which  disturbed  the  salt  gradient  and  re¬ 
duced  collection  efficiency  would  still  leave  weeks'  worth  of  recoverable  heat. 

Similarly,  ice  ponds  (McPhee  1981a]  provide  full  seasonal  storage  of  coolth, 
offering  reliable  air-conditioning  at  a  tenth  of  the  usual  energy  cost. 

Vehicular  fuels.  Enough  liquid  fuels  can  be  sustainably  produced  from 
farm  and  forestry  wastes  (not  special  crops)  to  run  an  efficient  vehicle  fleet 
[SERI  1981;  OTA  1980].  This  will  require  careful  management  and,  most  likely, 
basic  reforms  of  cultural  practice  which  are  in  any  case  essential  to  protect 
soil  fertility  (Jackson  1980].  Primers  on  biomass  liquids  have  been  published 
elsewhere  [SERI  1981;  OTA  1980;  Energy  &  Defense  Project  1980;  Lovins  &  Lovins 

. 
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1981],  The  main  types  are  pyrolysis  "oil"  made  by  heating  woody  substances 
with  little  air;  such  "oil"  slurried  with  char  produced  in  the  same  process; 
methanol;  ethanol;  butanol;  and  blends  of  various  alcohols.  (Gasohol®  is  a 
blend  of  10%  anhydrous  ethanol  with  90%  gasoline.)  Some  of  these  fuels  are 
usable  directly  in  unmodified  engines;  others  require  minor  modification  which 
costs  up  to  several  hundred  dollars  for  retrofit  or  nothing  at  the  factory.  It 
would  be  helpful  for  preparedness  if,  for  example,  car  makers  used  methanol- 
proof  components  in  fuel  systems,  and  provided  carburetors  with  a  switch  for 
easy  conversion  between  gasoline,  gasoline/alcohol  blends,  and  pure  alcohol. 

Excellent  manuals  on  commercial  ethanol  production  from  crops  are  avail¬ 
able  [SERI  1980,1980a],  though  so  far  similar  material  is  not  available  for 
other,  more  promising,  feedstocks,  processes,  and  products.  Extensive  grass¬ 
roots  training  programs  in  ethanol  still  construction  and  operation  are  provid¬ 
ed  by  a  wide  range  of  groups,  especially  in  the  Midwest  [Energy  Consumer  1980]. 
Given  that  knowledge,  a  still  big  enough  to  run  a  car  can  be  built  from  common¬ 
ly  available  materials  in  a  few  days  and  operated  from  almost  any  sugary  or 
starchy  feedstock.  Although  not  energy-eff icient ,  it  does  provide  a  premium 
fuel  from  what  may  otherwise  be  waste  materials.  Small-  and  medium-sized  eth¬ 
anol  plants  offer  interesting  advantages  for  integration  into  farm  operations 
[Patterson  1980]  and  are  attracting  special  interest  as  a  community  economic 
development  tool  at  small  Black  colleges  [Billingsley  1980].  Whether  ethanol 
is  produced  in  small  stills  or  (preferably)  a  wider  range  of  fuels  is  produced 
by  more  efficient  methods  from  non-crop  feedstocks  (especially  cellulosic 
wastes),  the  potential  contribution,  both  routine  and  emergency,  from  many 
small  plants  could  be  very  large.  As  an  analogy,  in  the  U.S.  about  11  million 
cows  in  herds  averaging  60  cows  produce  15  billion  gallons  of  milk  per  year — 
about  a  fifth  as  many  gallons  as  the  gasoline  used  annually  by  U.S.  cars.  Yet 
that  milk  production  "is  efficiently  supplied  by  small-scale  decentralized  op¬ 
erations."  [Hobson  1980].  Likewise,  "The  average  stripper  well  produces  about 
2.8  barrels  of  oil  per  day,  which  is  about  one-seventh  of  one  one-thousandth  of 
a  percent  of  what  we  consume  in  oil  every  day , . .  .but . .  .the  cumulative  effect  of 
all  our  stripper  wells  [is]... 21%  of  continental  oil  production."  (Hallberg 
1981],  Moreover,  alcohol  production  based  on  farm  and  forestry  wastes  would 
tend  to  be  concentrated  in  the  rural  areas  which  have  disproport ionate  needs 
for  mobility  fuels  [Hallberg  1980],  which  are  at  the  end  of  conventional  supply 
lines,  and  which  cannot  export  food  to  the  cities  without  adequate  fuel.  It  is 
for  this  reason  that  Admiral  Moorer,  former  Chairman  of  the  Joint  Chiefs  of 
Staff,  noted  "the  valuable  contribution  of  a  highly  dispersed,  self-contained 
liquid  fuel  production  system  to  serve  the  vast  U.S.  farming  community  in  deve¬ 
loping  the  strategic  defenses  of  the  United  States"  [Holmberg  1981]. 
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Many  people  think  only  of  corn-based  ethanol  when  biomass  liquids  are  men¬ 
tioned.  In  fact,  this  is  far  from  the  only  important  feedstock,  process,  or 
product,  and — especially  with  the  inefficient,  oil-  or  gas-fired  stills  common¬ 
ly  used--is  among  the  least  attractive.  Other  processes,  notably  thermochemi¬ 
cal  ones,  hav  -tter  economics  and  at  least  equal  technical  simplicity.  (John 
Tatom  [4074  Ridge  Rd . ,  Smyrna  GA  30080]  has  designed  effective  pyrolyzers  for 
developing  countries,  made  of  old  oil  drums,  rocks,  and  pieces  of  pipe.)  Feed¬ 
stocks  abound,  even  in  urban  areas:  just  the  pure,  separated  tree  material  sent 
each  day  to  Los  Angeles  County  landfills,  not  counting  mixed  truckloads,  is 
4000-8000  tons  with  an  energy  content  of  the  order  of  1  GWt .  At  a  nominal  con¬ 
version  efficiency  of  70%,  and  assuming  a  source  term  of  1  GWt,  the  resulting 
fuel  yield — equivalent  to  the  energy  content  of  nearly  half  a  million  gallons 
of  gasoline  per  day — would  suffice  to  drive  a  60-mpg  car  more  than  ten  miles 
per  day  for  every  household  in  the  County.  The  cotton-gin  trash  in  Texas  is 
enough  to  run  every  vehicle  in  Texas  at  present  efficiencies.  The  distressed 
grain  in  Nebraska  would  fuel  a  tenth  of  the  cars  in  Nebraska  at  60  mpg,  and  at 
the  same  efficiency  the  straw  burned  in  the  fields  of  France  or  Denmark  each 
year  would  fuel  every  car  in  the  country.  Feedstocks  range  from  walnut  shells 
and  rice  straw  in  California  to  peach-pits  in  Georgia  and  apple  pumice  (left 
after  squeezing  cider)  in  Pennsylvania.  But  numerous  small,  localized  terms 
add  up  to  enough — including  logging  wastes — to  fuel  an  expanded  U . S .  transport 
system  at  cost-effective  levels  of  efficiency  [SERI  1981], 

Technical  developments  in  providing  cost-effective  biomass  liquid  fuels 
are  of  three  main  types.  The  first,  most  important,  and  least  supported  is 
reform  in  farming  and  forestry  practice  to  make  these  activities  sustainable  by 
protecting  soil  fertility  while  at  the  same  time  providing  residues  for  fuel 
conversion  [Lovins  &  Lovins  1981;  Jackson  1980].  This  is  an  intricate  biologi¬ 
cal,  social,  and  economic  question  which  no  Federal  program  begins  to  address; 
but  without  it,  Americans  will  not  long  remain  able  to  feed  themselves.  The 
second  is  the  improvement  of  processes  to  ferment  sugars  or  starches  into  eth¬ 
anol.  For  example,  a  few  years  ago  it  took  50-100,000  BTU  to  distill  ethanol 
to  190°PR.  Today  some  commercial  processes  use  25,000  to  go  all  the  way  to  an¬ 
hydrous  ethanol  [BioSynthetics  19811,  and  the  best  demonstrated  proceses  have 
reduced  this  to  8-10,000,  using  advanced  distillation  or  critical-fluid  proces¬ 
ses  [Ferchack  &  Pye  1981],  Innovative  water-alcohol  separation  processes  in¬ 
clude  freezing  (New  England  applejack  and  Appalachian  moonshine  were  long  for¬ 
tified  by  leaving  the  kegs  out  to  freeze),  chemical  extractants,  hydrophobic 
plastics,  cellulosic  adsorbants  [Ladisch  et  al .  1978],  and — just  emerging — 

synthetic  membranes  [Ferchack  &  Pye  1981],  Good  process  efficiencies,  in 
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weight  yield  from  feedstock  to  alcohol,  are  now  typically  0.46-0.48 — 90-95%  of 
the  theoretical  limit — for  glucose  fermentation  to  ethanol.  These  processes 
are  likely  to  become  widely  available  at  all  scales  of  operation  over  the  ie:-;t 
few  years. 

The  third  and  technically  most  exciting  line  of  development  is  the  evolu¬ 
tion  of  new  processes  (or  refinement  of  old  ones — acid  hydrolysis  has  been  in 
use  for  over  a  century)  to  convert  cellulosic  wastes,  the  most  versatile  and 
abundant  kind,  into  alcohols.  Acid  hydrolysis  can  break  down  cellulose  to 
glucose  with  virtually  complete  yields  [Ladi sch  etal  .  1978],  providing  a  yield 
of  over  0.4  from  cellulose  to  ethanol  [Ferchack  &  Pye  1981a;  SERI  1981].  Ther¬ 
mochemical  processes  can  yield  methanol  by  the  routine  catalytic  "shift  reac¬ 
tion"  [SERI  1981 : II : 583f f ]  of  synthesis  gas  (a  hydrogen/carbon-monoxide  mixture 
produced  by  oxygen  gasification  of  biomass)  with  steam.  Using  modified  coal- 
conversion  technology,  which  is  not  optimal  for  biomass,  the  yield  of  the  whole 
process  is  about  0.40-0.48  [OTA  1980].  A  new  downdraft  gasifier  has  increased 
the  methanol  yield  to  an  astonishing  0.83  [SERI  1981:11:585].  Pyrolytic  "oil" 
production  yields  at  least  0.5  [LindstrBm  1979],  and  typically  0.6-0. 8 
including  the  slurried  char,  even  in  small  plants  that  can  fit  on  the  back  of  a 
pickup  truck  [Tatom  et  al .  1976]  .  Methanol  has  long  been  used  as  a  racing-car 

fuel  for  its  high  performance,  cleanliness,  and  safety;  in  a  high-compression- 
ratio  car  (say,  14:1  or  more),  it  can  readily  supply  only  20-25%  fewer  mpg  than 
gasoline,  even  though  its  energy  content  per  gallon  is  only  half  as  great. 
Methanol/ethanol/ ter t-butanol  blends  and  other  combinations  can  be  even  more 
advantageous  [Tom  Reed,  SERI,  pers.  cotmnun.  1980].  Since  cellulosic  feedstocks 
are  the  most  widespread  and  the  easiest  to  convert  and  use  efficiently  in 
small,  dispersed  plants  using  low  technology,  the  emerging  cellulosic  conver¬ 
sion  processes  seem  particularly  advantageous  for  building  a  nearly  invulner¬ 
able  national  capability  for  dispersed,  sustainable  liquid  fuel  production. 

Road  vehicles  can  be  run  on  other  than  liquid  fuels.  Canada  has  a  program 
of  conversion  to  compressed  natural  gas  (a  method  already  used  by  some  hobby¬ 
ists)  and  to  LPG*.  A  million  portable  wood  gasifiers  (p.  149)  ran  European  cars 
during  World  War  II.  Extensive  data  are  available  [ IngeniBrsvetenskapsakada- 
mien  1950]  on  their  design  and  performance.  Although  they  take  about  an  hour  a 
day  to  fuel  and  care  for,  and  consume  22  lb  of  dry  wood  per  gallon  gasoline 
equivalent,  they  are  such  a  robust  substitute  in  heavily  wooded  regions  that 
Sweden  is  considering  stockpiling  gasifiers  in  case  of  severe  gasoline  short¬ 
age.  Other  alternatives  are  conceivable:  heat  engines  based  on  liquid  air  may 
be  interesting,  and  electric  cars,  though  uncompetitive  in  principle  with  effi¬ 
cient  fueled  cars,  might  become  viable  with  very  cheap  on-car  photovol ta i cs . 
*About  3  million  LPG  carburetors  have  been  sold  in  the  U.S.  since  1969. 
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El ectricity.  The  most  commonly  discussed  renewable  electrical  sources  are 
microhydroelectricity,  wind  electricity,  and  photovol t aics  (solar  cells).  Wind 
and  microhydro  can  also  be  used  for  pumping  water  or  heat,  for  compressing 
storable  air  to  run  machines,  or  even  for  refrigeration  [Franklin  1980]. 

A  little-known  option  may,  in  favorable  sites,  be  the  cheapest  known 
source  of  new  baseload  electricity:  a  solar  pond  with  a  low-temperature  (e.g. 
Rankine)  heat  engine,  especially  if  it  works  into  an  ice  pond  as  suggested  by 
T.B.  Taylor.  Israel  has  operated  a  150-kWe  solar  pond/Rankine  engine  since 
1979;  plans  5  MWe  at  ca.  $2000/kWe  in  1983;  plans  2  GWe  in  floating  solar  ponds 
in  the  Dead  Sea  by  2000;  and  projects  4-7i/kW-h  for  a  proposed  Southern  Cali¬ 
fornia  Edison  Co.  plan  (officially  projected  at  7-10i)  in  the  Salton  Sea. 

Small  hydro — variously  defined  as  less  than  5-25  MWe  or  less  than  100  kWe 
per  site — is  being  intensively  exploited  by  entrepreneurs  [McPhee  1981].  All 
but  forgotten  until  1976-77  [Congressional  Research  Service  1978:48-128],  in¬ 
numerable  small  dams,  including  over  ten  thousand  in  New  England  alone,  had 
been  abandoned.  (Many  existing  large  dams  were  also  left  with  empty  turbine 
bays:  _id_.  :129— 136]  .)  The  National  Hydroelectric  Power  Study  by  the  Army  Corps 
of  Engineers,  due  to  be  completed  in  autumn  1981,  is  reportedly  identifying 
still  more  opportunities.  Some  sites  are  environmentally  or  institutionally 
unsuitable  [Frankl in  P ierce  Energy  Law  Center],  but  many  others  can  be  refur¬ 
bished  (and  some  developed  from  scratch)  using  straightforward  and  cost-effe¬ 
ctive  technologies  [Energy  &  Defense  Project  1980:178-84]  for  which  a  do-it- 
yourself  manual  is  available  [Alward  et  al .  1979],  Run-of-the-r iver  sites  and 
heads  as  low  as  5'  can  be  used  [Schneider  Corp.  1980]. 

The  rate  of  progress  is  hard  to  measure  because  many  utilities  seem  to 
underreport  their  hydro  projects:  e.g..  Pacific  Gas  &  Electric  and  Southern  Cal 
lifornia  Edison  reported  170  MWe  of  hydro  in  the  January  1981  Electrical  World 
survey  of  capacity  additions  underway ,.  but  the  California  Energy  Commission's 
staff  report  on  the  proposed  Allen-Warner  Valley  coal  project  lists,  for  these 
two  companies  respectively,  707  and  1150  MWe  as  "reasonably  expected  to  occur" 
and  ca.  1500  and  750  MWe  as  "additional,  but  not  counted."  Thus  projects  alrea 
dy  underway,  most  of  them  with  FERC  permits  filed  for,  total  1857  MWe — over  ten 
times  what  the  EW. survey  reflects  [Jim  Harding,  pers.comm. ,  19  May  1981].  A 
further  barrier  is  that  the  Federal  Energy  Regulatory  Commission  is  inundated 
with  license  applications — 2600  averaging  8  MWe  in  the  two  years  ended  July 
1981  —  including  some  applications  apparently  filed  by  a  few  companies  that 
intend  to  sit  on  them  or  resell  them  at  "scalper's"  profits.  Nonetheless,  the 
impact  of  microhydro  is  already  locally  substantial  (McPhee  1981)  and  should 
over  the  next  few  decades  approach  the  same  magnitude  as  existing  large-  scale 
hydroelectricity — but  far  more  evenly  distributed  around  the  country*. 


♦Sweden  plans  250  installations  by  1982;  New  Zealand  has  60  and  plans  more 
[Gouraud  1981]. 
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Microhydro  shouLd  be  speeded  by  new  companies  providing  a  "no-hassle"  turnkey 
development  service  and  by  the  imminent  entry  into  the  U.S.  market  of  cheap 
Chinese  turbines  (designed  by  American  engineers  a  half-century  ago).  China, 
as  mentioned  on  pp.  49-50,  now  claims  to  get  over  5.4  GWe  from  over  90,000 
local  microhydro  sets  (few  of  them  grid-connected  [Energy  &  Defense  Project 
1980:178])  ranging  from  0.6  to  100  kWe,  usually  with  0-5  m  heads.  This  adds  up 
to  at  least  two-thirds  of  all  Chinese  eLectricity  outside  the  cities  [Lovins 
1977b: 124  ],  and  powers  over  half  of  the  dispersed  light  industry — an  important 
element  of  Chinese  civil  defense  planning. 

Windpower  has  the  disadvantage  (compared  to  flat-plate  photovol taics )  of 
moving  parts,  but  the  considerable  advantage  of  high  power  density.  A  machine 
extracting  30%  of  the  power  in  the  wind — reasonable  performance  for  a  good 
design  without  fancy  equipment  (tipvanes,  shrouds,  variable  pitch,  etc.) — can 
extract  24  W  per  m^  of  swept  area  at  an  average  windspeed  of  4  m/s;  81  W  at 
6  m/ s ;  192  W  at  8  m/s  [Sorensen  1979a:6].  In  contrast,  a  10%-ef f icient  solar 
cell  in  average  U.S.  insolation  extracts  only  18  W/m2.  Accordingly,  a  sim¬ 
ple  wind  machine  can  capture  mechanical  work  at  very  low  prices.  Simple  designs 
like  that  mentioned  on  p.  152  and  pp.  206-7  [Bergey  1981],  or  the  $1500  (1980 
$)  homemade  (est.  $6700  commercial)  17.5-kWp  (@  17  m/s)  Chalk  wheel  of  Otto 
Smith  [Lovins  1978:496],  are  becoming  available.  The  Borre  sailwing  design 
[ id . ]  is  on  the  market  as  an  18-kWp  model  for  about  $650-690/kWp  (1980  $) 

[Carter  1978],  producing  at  about  5±/kW-h  (1980  $).  U.S.  Windpower  machines 
based  on  commonly  available  components  are  selling  (complete  except  tower,  FOB 
factory,  1981)  for  $610-700/kWp  in  the  25  kW  (model  CA)  and  37  kW  (CB)  sizes 
[Stoddard  1981],  and  a  refined  prototype  can  be  made  for  about  half  that  such 
[ id . ]  .  A  private  entrepreneur,  Terry  Merkham,  recently  built  a  1-MWp  machine 
for  a  P ennsyl vania  factory  at  a  cost  (materials  plus  labor)  of  $400/kWp.  The 
more  than  40  manufacturers  of  small  machines  are  listed  in  periodic  indices  pub¬ 
lished  by  Wind  Power  Digest,  the  American  Wind  Energy  Association,  and  the  Rock¬ 
well  International  wind  test  program  at  Rocky  Flats.  Basic  guides  to  selecting 
wind  machines  [Park  1981]  and  their  sites  [Wegley  et  al .  1978]  are  bringing  the 
technology  into  common  currency.  New  "wind  prospecting"  methods  include  satel¬ 
lite  observation  of  inversion  breakup  (U.  of  Alaska)  and  detailed  computer 
simulation  of  windflow  over  digitized  terrain  (Lawrence  Livermore). 

Large-scale  commercial  wind  projects  are  springing  up.  Southern  California 
Edison  Co.,  operating  a  3-MW  hydraulically  coupled  machine  designed  by  Charles 
Schachle,  has  already  contracted  for  55  MWe  of  wind  capacity  from  entrepreneurs 
and  is  negotiating  for  another  215  MWe.  California  expects  to  get  1%  of  its 
electricity  from  wind  in  1985  and  10%  in  2000:  a  350-MWe  windfarm  30  miles  NE 
of  San  Francisco  is  to  be  built  during  1983-89,  to  supply  nearly  1  TW-h/y  at 
3.5i/kW-h  real,  and  U.S.  Windpower  is  currently  installing  a  200  *  50  kWp 
array,  with  600  machines  to  be  supplying  90  GW-h/y  by  mid-1983.  The  same  firm 
built  20  50-kW  machines  on  Crotched  Mountain,  N.H.,  within  five  months  of  first 
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contacting  the  site  owner,  and  hooked  them  to  the  utility  grid  in  late  1980  in 
a  nutually  profitable  synbiosis  [Graves  1981].  Windfarms"  has  contracted  (sub¬ 
ject  to  financing)  to  supply  92  of  Hawaiian  Electric  Company's  electricity  by 
1985  via  20  4-MW  wind  machines  on  Oahu.  A  private  entrepreneur,  Jay  Carter,  ha 
reportedly  built  125  sailwing  gyromills  of  25-30  kW  each,  listing  at  $18,000, 
to  run  a  bleach  plant  in  Dalhart,  Texas  [Energy  Research  Reports  1979]. 

Photovol taics  are  extremely  durable,  reliable,  and  simple  to  use:  when 
placed  in  the  sun,  they  produce  direct  current,  needing  no  maintenance  unless 
they  have  a  tracking  concentrator.  These  qualities  have  long  commended  them 
for  such  applications  as  powering  buoys,  highway  signs,  Forest  Service  towers, 
microwave  relay  stations,  and  remote  military  bases  (part  of  the  rationale  for 
proposed  DOD  purchases  [Congressional  Research  Service  1978:223-274]).  As  with 
transistors  in  the  1950s  and  1960s  and  integrated  circuits  in  the  1970s,  the 
cost  even  of  convent ional ,  first-generation  cells  (Czochralski  silicon  wafers) 
has  been  falling  dramatically,  with  array  prices  dropping  from  about  $30/W 

1976  to  $7-10/Wp  in  1979-80.  (Photovoltaics  are  rated  in  peak  watts  or  Wp 
of  direct-current  output  at  1  kW/m^  insolation.)  There  is  a  consensus 
among  the  managers  of  the  very  competently  run  Federal  program  that  implement¬ 
ing  proven  technologies  for  producing  such  cells  in  a  more  automated  fashion, 
without  the  30-odd  hand  operations  now  needed,  can  reduce  the  array  price  to 
$2.80/Wp  (1980  $)  by  late  1982,  corresponding  to  an  installed  whole-system 
price  of  about  $6-13/Wp  for  flat-plate  systems  [JPL  1980;  Smith  1981], 

It  is  also  highly  likely  that  several  of  the  second-generation  processes 
already  demonstrated  and  in  advanced  commercial  development — silicon  web  or 
ribbon  growth,  amorphous  silicon  films  (which  can  be  very  cheaply  vacuum-depo¬ 
sited  on  anything,  including  plastic  films),  or  other  materials — will  achieve, 
on  or  ahead  of  schedule,  the  DOE  1986  array-price  goal  of  $0.70/W  (1980  $), 

corresponding  to  a  whole-system  price  of  $1 .60-2 . 60/Wp.  Sanyo  has  already  in¬ 
vested  $50  million  in  a  factory  for  commercial  production  of  amorphous  silicon 
cells  [Maycock  1981],  and  several  firms  have  announced  the  development  of  anply 
efficient  amorphous  materials  which  they  expect  to  market  by  about  1985  at 
about  $0.70/ty>  or  less.  One  such  material,  developed  by  AMETEK  [1979],  can  be 
applied  by  a  simple  wet-chemical  process  similar  to  electroplating;  is  already 
about  8%  efficient;  has  a  materials  cost  of  40i/Wp;  and  can  be  applied  to  the 
absorber  plate  of  an  AMETEK  flat-plate  solar  heat  collector  to  produce  electri¬ 
city  as  a  byproduct.  Collector  glazings  can  also  be  used  as  nonfocusing  con¬ 
centrators  by  dispersing  a  fluorescent  dye  in  the  glazing  material  so  that  the 
fluorescence  is  internally  reflected  to  a  photovoltaic  strip  along  one  unsil¬ 
vered  edge:  a  small  cell  area  could  thus  produce  byproduct  electricity. 
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Detailed  economic  calculations  show  that  the  confidently  expected  1986 
prices,  assuming  no  technological  breakthroughs,  will  compete  with  grid  elec¬ 
tricity  in  most  of  the  U.S.  [Russell  1981].  Accordingly,  DOE's  Solar  Photo- 
voltaics  Energy  Advisory  Committee  stated  in  February  1981  that  a  combination 
of  rapid  technical  advances,  PURPA  buyback  provisions,  and  higher  marginal  cost 
estimates  for  conventional  sources  make  it  likely  that  central-station  photo- 
voltaics  will  compete  around  1986  [Adler  1981] — which  means  that  well-designed 
cogeneration  versions  should  compete  around  1981-82  on  a  residential  scale  and 
starting  several  years  ago  on  a  community  scale  [Ross  &  Williams  1981). 

It  will  probably  be  fairly  common  for  new  houses  (and  some  old  ones)  by 
the  late  1980s  to  be  net  exporters  of  electricity.  General  Electric  is  devel¬ 
oping  photovoltaic  shingles  which  cost  about  the  same  as  normal  shingles  but 
produce  electricity  too  and  are  hooked  up  by  nailing  them  onto  the  roof.  Texas 
Instruments  is  developing  a  clever  photovolta ic-hyctogen  system  with  onsite  hy¬ 
drogen  storage  and  a  fuel  cell.  Technical  developments  in  this  field  are  mov¬ 
ing,  as  is  the  way  of  semiconductors,  too  quickly  even  to  report.  This  puts  an 
extra  sense  of  urgency  into  our  findings  about  the  risk  of  utility  bankruptcy 
(Appendix  A)  and  the  need  to  plan  for  the  long-term  shape  of  renewable  source 
integration  into  the  power  grid  (pp.  224-228  above).  The  photovoltaics  revolu¬ 
tion  is  indeed  already  upon  us  (p.  236).  We  had  better  start  getting  used  to 
the  idea  and  figuring  out  how  best  to  use  these  rugged,  almost  invulnerable 
devices  to  increase  the  resilience  of  national  electrical  supply. 

In  summary,  then:  the  most  up-to-date  surveys  of  the  status  of  renewable 
sources  find  [e.g.  SERI  1981]  that  cost-effective  renewable  technologies  now  in 
or  entering  commercial  service  are  sufficient  to  meet  at  least  most,  and  prob¬ 
ably  about  all,  energy  needs  of  the  United  States  within  the  lifetime  of  power 
stations  now  being  commissioned.  In  conjunction  with  even  more  cost-effective 
efficiency  improvements,  these  inherently  resilient  sources  can  profoundly 
improve  national  security  by  making  impossible  many  types  of  large-scale 
failure  of  energy  supply  and  many  of  the  side-effects  of  failures  in  dangerous 
energy  systems.  These  developments  have  so  far  received  virtually  no  profes¬ 
sional  attention  outside  the  relatively  small  number  of  energy  specialists  who 
have  kept  up  with  them.  Yet  they  offer  arguably  the  greatest  nat ional-secur i ty 
opportunity  in  our  lifetimes. 

The  concluding  chapter  of  this  survey,  therefore,  seeks  to  pull  together 
the  threads  of  this  analysis  in  order  that  those  concerned  with  preparedness 
and  resilience  may  be  better  able  to  grasp  this  extraordinary  chance  to  turn 
a  present  danger  into  a  new  source  of  security  and  prosperity. 
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8-  IMPLICATIONS  FOR  PREPAREDNESS 

The  foregoing  Chapters  have  sought  to  show,  generically  and  specifically, 
what  makes  the  present  energy  system  vulnerable;  how  to  design  a  far  less  vul¬ 
nerable  system;  and  how  in  particular  a  conbination  of  efficient  energy  use  and 
appropriate  renewables  (properly  built  and  interrelated)  can  achieve  a  high 
degree  of  inherent  resilience  while  simultaneously  minimizing  the  economic 
costs  of  providing  energy  services. 

To  date  it  has  often  been  the  economic  benefits  of  this  more  resilient 
strategy,  not  its  preparedness  advantages,  that  have  attracted  notice,  support, 
and  action.  While  the  specter  of  oil  cutoffs  is  at  the  back  of  people's  minds, 
the  reality  of  day-to-day  energy  costs  is  at  the  front.  The  importance  of  re¬ 
ducing  those  costs  is  most  visible  not  at  a  national  level,  where  an  oil-import 
bill  of  thousands  of  dollars  per  second  is  too  big  to  visualize,  but  at  a  local 
level,  where  household  energy  bills  are  all  too  obvious.  At  a  local  level, 
moreover,  the  problem  and  solution  can  be  stated  in  concrete  and  memorable 
terms,  and  specific  opportunities  for  and  obstacles  to  such  a  policy  can  be 
most  directly  identified  and  dealt  with.  Accordingly,  for  coping  with  energy 
disruptions  or  the  threat  of  them,  community-based  action  is  the  fastest  and 
most  efficient  way  to  build  a  resilient  energy  system.  Support  for  such  local 
analysis  and  action — reinforcement  of  what  is  already  a  rapidly  growing 
national  trend — is  our  first  and  most  important  recommendation. 

The  reasons  for  this  trend  can  be  vividly  illustrated  by  four  recent  local 
efforts  to  improve  energy  resilience:  one  arising  from  stark  economic  necessity, 
one  from  foresight  and  planning,  and  two  from  actual  supply  cutoffs.  The  first 
of  these  examples--an  analysis  of  the  needs  of  a  local  economy,  and  a  political 
process  giving  substantive  form  to  that  analysis — comes  from  Franklin  County, 
the  poorest  county  in  Massachusetts:  cold,  cloudy,  economically  depressed,  and 
almost  wholly  dependent  on  imported  oil.  A  group  of  citizens  with  a  $30,000 
DOE  grant  several  years  ago  drew  on  a  range  of  community  resources  aid  partici¬ 
pation  to  analyze  the  County's  energy  future  [Pomerance  et  al .  1979]. 

They  began  with  a  dismal  energy  present.  Every  year,  the  average  Franklin 
County  household  was  sending  out  of  the  County  more  than  $1300  to  pay  for  ener¬ 
gy.  At  an  informal  "town  meeting"  to  discuss  the  study's  findings,  someone 
held  up  a  bucket  with  a  hole  in  it,  to  dramatize  the  drain  of  $23  million  per 
year  from  Franklin  County,  mostly  to  Venezuela.  That  drain  was  the  same  as  the 
total  payroll  of  the  ten  largest  employers  in  the  County.  (The  total  County 
energy  import  bill  for  all  sectors  was  about  $48  million  in  1975,  rising  in  1980 
to  $108  million  (current  $1 — of  which  $52  million  was  just  for  households.) 
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The  analysts  next  showed  that  if  the  1  owe s t  official  forecasts  of  energy  needs 
and  prices  in  2000  became  reality,  people  would  become  four  times  worse  off, 
paying  $5300-odd  per  year  (not  counting  inflation)  to  buy  household  energy  from 
outside  the  County  and,  generally,  out-  ide  the  country.  To  keep  that  leaky 
bucket  full,  the  biggest  single  employer  in  the  County  would  have  to  clone 
itself  every  few  years  for  the  rest  of  the  century.  This  prospect  made  the 
Chanfoer  of  Commerce  and  utility  people  blanch:  the  future,  presented  in  such 
terms,  was  simply  not  possible. 

The  study  group  had,  however,  worked  out  what  could  be  done  instead:  mak¬ 
ing  the  buildings  heat-tight,  using  passive  and  active  solar  heat,  running  ve¬ 
hicles  on  methanol  from  the  sustained  yield  of  some  unallocated  public  wood- 
lots,  and  meeting  electrical  needs  with  wind  or  microhydro  within  the  County. 
Local  machine  shops,  with  skilled  workers  unemployed,  could  make  all  the  equip¬ 
ment.  The  cost  of  paying  it  off  would  be  about  the  same  the  County  was  then 
paying  for  household  energy — about  $23  million  per  year.  But  the  leaky  bucket 
would  thereby  be  plugged  up.  The  money,  the  jobs,  the  economic  multiplier 
effects  would  stay  in  Franklin  County,  not  go  to  Venezuela. 

Before  the  1973  oil  enbargo,  a  dollar  used  to  circulate  within  the  County 
some  26  times  before  going  outside  to  buy  an  import;  today,  it  circulates  fewer 
than  ten  times.  Franklin  County  is  hemorrhaging  money.  A  fair  consensus  devel¬ 
oped,  as  a  result  of  this  analysis,  that  the  only  hope  for  economic  regenera¬ 
tion  would  be  to  stop  the  bleeding  by  promoting  local  energy  efficiency  and 
self-reliant  renewable  supply.  As  a  result,  what  was  a  paper  study  is  now  the 
Franklin  County  Energy  Project.  With  various  fits  and  starts — and  considerably 
delayed  by  the  sudden  loss  of  its  modest  Federal  funding — it  is  starting  to  be 
inplemented.  Once  the  energy  problem  was  so  presented  that  people  could  see  it 
as  their  problem,  and  one  not  just  of  convenience  but  of  economic  survival, 
they  were  motivated  to  start  solving  that  problem  on  their  own.  More  recently, 
a  broadly  similar  process  has  grown  up  in  thousands  of  American  counties,  cit¬ 
ies,  and  towns  [SERI  1980b , 1981  a] .  The  U.S.  energy  system  is^  actually  devel¬ 
oping  a  measure  of  economic  efficiency  and  preparedness,  but  largely  from  the 
bottom  up,  not  from  the  top  down. 

A  second  example  of  local  energy  efforts  arose  chiefly  from  concerns  about 
energy  vulnerability  rather  than  cost.  Dade  County,  Florida  is  currently  assem¬ 
bling  a  coherent  Energy  Contingency  Plan  [Leslie  Brook,  pers.  comnxin.,  18  May 
1981].  Its  first  element,  a  Fuel  Management  Program,  has  not  only  contributed 
to  preparedness — through  efficiency  in  the  6600  County  vehicles,  establishing 
priorities,  stockpiling  to  maintain  essential  services  through  several  months' 
conplete  cutoff,  and  a  wide  range  of  other  measures — but  has  set  up  more  effi¬ 
cient  accounting  controls  which  have  since  1973  saved  the  County  more  than  13 
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million  gal  Lons  of  motor  tael.  The  County's  impressive  energy  management  acti¬ 
vities  (MetroDade  1980a]  include  not  only  cr isis-management  measures  but  also 
ef f iciency/ renewables  programs  designed  to  prevent  crises  from  arising.  When 
Federal  contracting  was  recently  frozen,  Dade  County  officials  were  in  the  pro¬ 
cess  of  developing  curricula  and  workshops  to  train  other  local  officials  in 
this  broad  approach  to  energy  preparedness  [MetroDade  1980]  . 

While  Dade  County's  analysis  is  neither  as  broad  nor  as  deep  as  we  have 
attenpted  here,  its  integration  of  preventive  measures  with  crisis-management 
measures  is  a  useful  model  for  developing  further  the  essential  idea  that  ener¬ 
gy  preparedness  consists  of  far  more  than  having  a  paper  plan  for  rationing 
gasoline.  If  Florida's  energy  supplies  are  seriously  disrupted  in  the  future, 
it  is  likely  that  Dade  County — knowing  how  its  energy  is  used  and  having  well- 
established  procedures  in  place  for  orderly  maintenance  of  vital  services  will 
be  better  off  than  most  other  areas.  The  County's  motivation  was  in  part  the 
conviction,  as  the  program's  Deputy  Director  expressed  it  [Brook  loc .  cit .  ], 
that  energy  emergency  preparedness  "is  a  critical  issue  of  national  security 
and  ought  to  be  a  top  priority  of  the  United  States  Department  of  Defense.  It 
is  heartening  that  some  local  officials  are  taking  national  concerns  so  nuch  to 
heart--but  it  is  hardly  surprising  in  view  of  the  tangible  local  benefits. 

Such  advance  planning  is  still  exceptional.  The  disruptions  we  described 
in  earlier  chapters  are  still  the  stuff  of  everyday  life  whenever  several  things 
go  wrong  at  the  same  time.  In  the  January  1981  cold  spell,  for  example,  schools 
and  some  businesses  in  several  eastern  Massachusetts  comntini t ies  had  to  close 
because  a  storm  off  of  Algeria  had  sunk  an  LNG  tanker  on  28  Decenber  1980 
[Knight  1981],  causing  Massachusetts  gas  companies  to  deplete  their  stockpiles 
when  pipeline  capacity  proved  inadequate  to  import  gas  they  had  stored  in  Penn¬ 
sylvania.  Such  incidents  remain  fairly  common,  and  the  only  response  local 
officials  can  make  is  curtailment:  turn  down  thermostats,  huddle  over  wood 
stoves,  shut  down  factories,  and  listen  to  emergency  broadcasts.  Yet  in  some 
communities  that  have  none  of  the  access  to  sophist  icated  management  and  resour- 
that  might  be  expected  in  Massachusetts,  actual  energy  shortages  have  already 
led  to  a  remarkably  effective  response. 

One  such  instance  is  fairly  well  known  [Energy  Consumer  1980b:23]:  the 
improvisat ion  of  mesquite  stoves  and  simple  solar  water  heaters  in  Crystal 
City,  Texas,  whose  natural  gas  supply  was  shut  off  in  the  late  autumn  of  1977 
in  a  dispute  over  prices.  Low  income  and  the  imminence  of  winter  forced  the 
townspeople  to  work  with  what  materials  they  had.  They  did  so  well  with 
weather i zat i on  and  renewables  that  many  are  still  using  and  indeed  expanding 
those  "stopgap"  measures:  responses  developed  expediently  served  to  introduce 
people  to  energy  options  of  which  they  had  previously  been  unaware  and  whose 
economic  advantages  they  then  wished  to  receive  routinely. 
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A  less  well-known  and  even  more  impressive  case  comes  from  Che  San  Luis 
Valley  in  southern  Colorado — a  sunny  but  cold  plateau  at  8000'  elevation, 
nearly  as  large  as  Delaware.  The  traditional  Hispanic  community  in  the  Valley 
heated  with  firewood,  cut  on  what  they  thought  was  their  commons-land  from  old 
Spanish  land-grants.  A  few  years  ago,  a  corporate  landowner  fenced  the  land 
and  started  shooting  at  people  who  tried  to  gather  wood.  The  people  thus  had 
an  instant  energy  crisis.  Some  of  the  poorest  people  in  the  United  States, 
they  could  not  afford  to  buy  wood  or  any  commercial  fuel.  But  a  few  people  in 
the  community  knew  how  to  build  very  cheap  solar  greenhouses  out  of  scrounged 
materials,  averaging  under  $200  each.  Through  hands-on  greenhouse  workshops, 
somewhat  akin  to  old-fashioned  barn-raisings,  the  word  spread  quickly.  In  a 
few  years,  the  Valley  has  gone  from  a  documented  four  to  over  800  greenhouses — 
which  not  only  provide  most  or  all  of  the  space  heating  but  also  extend  the 
growing  season  from  three  months  to  year-round,  greatly  improving  families' 
winter  nutrition  and  cash-flow.  There  are  solar  trailers,  a  solar  Post  Office, 
even  a  solar  mortuary.  Baskin  &  Robbins  has  installed  a  high-technology  solar 
system  on  its  ice-cream  parlor.  Now  other  renewable  sources  are  starting  to 
spread:  wind  machines  are  springing  up,  and  some  farmers  are  building  an  ethan¬ 
ol  plant  fed  with  cull  potatoes  and  barley  washings  and  powered  by  geothermal 
process  heat.  The  Valley  is  on  its  way  to  energy  self-reliance  because,  under 
the  pressure  of  a  supply  interruption,  people  found  they  were  too  poor  to  use 
anything  but  renewables. 

Tools  for  such  local  action  are  becoming  widely  available:  two  national 
conferences  on  community  renewable  energy  systems  [SERI  1980b , 1981a] ,  books  of 
case-studies  [Center  for  Renewable  Resources  1980;  Ridgeway  1979],  how-to  books 
[e.g.  Wilson  1981;  Reif  1981;  Morrison  1979],  guides  to  county  energy  analysis 
[Benson  &  Okagaki  1979],  indices  to  local  resources  [Department  of  Energy 
1980a],  technical  compendia  on  renewable  resource  bases  [Glidden  &  High  1980] 
and  technologies  [Soft  Energy  Notes],  and  introductions  to  community  planning 
for  resilience  [Corbett  1981].  Among  the  most  valuable  ways  of  putting  tools 
in  people's  hands  has  been  the  free  DOE  periodical  The  Energy  Consumer,  whose 
special  issues — on  such  subjects  as  solar  energy  [1979],  alcohol  fuels  [1980], 
comnunity  energy  programs  [1980a],  and  energy  preparedness  [1980b] — include 
comprehensive  state-by-state  indices  of  key  people  and  programs  to  help  local 
action.  In  1981,  unfortunately,  publication  of  The  Energy  Consumer  and  public 
distribution  of  its  back  issues  were  suspended  and  its  staff  was  disbanded,  so 
this  effective  source  of  self-help  information  was  lost. 

The  nunfcer,  diversity,  and  intensity  of  community-based  programs  for 
energy  efficiency  and  appropriate  renewable  supply  [SERI  1980b, 1981a]  have  led 
a  few  thoughtful  citizens  to  propose  the  concept  of  a  locally  based  "efficiency 
and-renewab les  mob il izat ion"  to  increase  national  energy  preparedness.  Chief 
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among  these  are  Fran  Roster  (former  director  of  TVA1 s  solar  programs  and  pre¬ 
viously  a  prime  mover  in  the  Franklin  County  Energy  Project)  and  Alec  Jenkins, 
working  in  his  private  capacity  (he  is  a  senior  staff  analyst  for  the  Califor¬ 
nia  Energy  Commission)  and  as  a  Division  Chairman  of  the  American  Section  of 
the  International  Solar  Energy  Society  (.AS/ISES).  Together  they  have  organized 
(generally  under  AS/ISES  auspices)  several  programs  to  explore  voluntary  "mobil¬ 
ization."  This  approach  presupposes  (Energy  Consumer  1980b : 1 3 f f ]  that  "energy 
shortages  will  not  be  half  so  politically  disruptive  if  communities  see  a 
timetable  and  a  supply  of  their  own  making,"  and  that  mobilization  should  seek 
to  anticipate  and  prevent  shortages,  not  merely  respond  to  them. 

The  "mobilization"  concept  recognizes  not  only  the  political  efficiency  of 
locally  based  decision  processes,  but  also  the  fact  that  in  hundreds  of  commun¬ 
ities  and  several  regions  (including  New  England  and  Southern  New  York  State), 
assessments  of  local  renewable  resources  have  found  "a  gold  mine  of  opportuni¬ 
ty"  [i_d . ] .  To  this  end,  Jenkins  and  Roster  and  their  colleagues  have  proposed 
to  AS/ISES  an  institute  to  speed  the  dissemination  of  tools  for  local  energy 
mobilization;  are  working  with  several  existing  efforts  to  train  local  govern¬ 
ment  officials;  have  sought  (so  far  unsuccessfully)  DOE  support  for  preparing  a 
"mobilization  handbook”  for  widespread  local  distribution;  and  are  hoping  to 
enlist  industry  as  a  major  constituency  and  actor  for  promoting  local  initia¬ 
tives.  Jenkins  is  also  preparing  a  paper  summarizing  the  mechanisms,  incen¬ 
tives,  and  organizational  patterns  that  seem  most  effective  in  promoting  com¬ 
munity  awareness  and  action  to  increase  energy  preparedness. 

The  remarkable  chord  that  these  citizen  actions  have  struck  rests  on  the 
widespread  perception,  especially  among  municipal  and  county  leaders,  that  if, 
or  more  likely  when,  energy  supplies  are  next  seriously  disrupted.  Federal 
programs,  with  the  best  will  in  the  world,  will  not  be  able  to  do  much  for  most 
people;  it  will  be  every  community  for  itself.  People  who  want  to  forestall 
the  resulting  inconvenience  or  hardship  can  therefore  be  persuaded  that  their 
best  protection  is  to  get  busy  with  efficiency  and  renewables — not  things  that 
others  may  do  for  them  in  ten  years,  but  things  that  they  can  do  for  themselves 
now.  Our  analysis,  based  on  meetings  in  hundreds  of  communities,  has  shown  that 
this  approach  is  indeed  the  most  fruitful,  for  it  responds  both  to  people's 
well-founded  anxieties  about  energy  supply  and  to  their  equally  shrewd  suspi¬ 
cion  that  there  is  a  great  deal  they  can  do  to  increase  their  personal  and  com¬ 
munity  energy  security — given  access  to  information*. 

*This  approach  raises  the  question  of  what  would  happen  if  before  or,  more 
likely,  during  a  crisis  a  great  many  people  were  to  try  to  insulate  houses, 
build  greenhouses  and  stills,  etc.  simultaneously.  Abbie  Page  at  The  MITRE 
Corporation  in  Bedford,  Massachusetts  is  eager  to  explore  where  bottlenecks 
would  arise  in  supplying  materials,  equipment,  and  skills,  and  how  these  snags 
could  be  avoided  by  preparedness  planning.  This  next  stage  of  analysis 
deserves  FEMA's  support. 
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In  a  country  as  large  and  diverse  as  the  United  States,  any  issue  aggrega¬ 
ted  to  a  Federal  level  tends  thereby  to  become  all  but  unmanageable.  Much  of 
the  current  Federal  trend  towards  devolving  choice  back  to  a  stat’  ';nd  local 
level  wisely  recognizes  that  unique  local  circumstances  can  often  be  best  dealt 
with  by  people  who  know  them  in  detail — provided  the  will  to  do  so  is  there. 

In  this  spirit,  existing  state  energy  and  emergency-planning  offices  could  play 
a  key  role  in  energy  preparedness,  and  a  few  are  already  doing  pioneering  work 
which  deserves  careful  consideration  by  Federal  officials. 

California,  for  example,  is  widely  regarded  as  the  leader — perhaps  just 
ahead  of  oil-dependent  Hawaii — in  analyzing  and  preparing  for  interruptions  of 
oil  supply  (and  to  a  lesser  extent  of  natural  gas  and  electricity).  This 
approach  and  expertise  are  in  part  an  outgrowth  of  the  high  expectation  of  a 
major  earthquake  and  of  state  experience  in  managing  drought.  The  state's  oil 
prospects  have  been  analyzed  at  a  sophisticated  level  [Ca.  Energy  Commission 
1981].  The  Energy  Commission's  Energy  Contingency  Planning  Staff,  led  by  Com¬ 
missioner  Varanini,  has  summarized  in  a  memorable  1981  wall-chart  ("Oil  Crisis 
Regulations")  the  labyrinth  of  present  arrangements — international.  Federal, 
state,  and  local — for  coping  with  an  oil  crisis,  and  has  shown  in  a  1980-81 
series  of  well-argued  papers  and  consequence  models  that  those  arrangements 
would  be  largely  unworkable  even  if  executed  with  perfect  competence. 

Energy  Emergency  Districts  have  been  proposed  [Energy  &  Defense  Project 
1980]  as  a  basis  for  an  inventory  and  mobilization  of  local  energy  sources  and 
skills,  and  for  demonstrating  local  renewable  sources'  potential  for  improving 
preparedness.  The  California  effort,  though  generally  supportive  of  the  local 
"mobilization"  concept  and  of  other  private  initiatives,  does  not  go  nearly  so 
far.  It  is  still  largely  directed  towards  managing  shortages,  not  with  the  more 
fundamental  shifts  in  strategy  needed  to  make  the  probability  and  consequences 
of  shortages  very  small.  Thus  although  the  efforts  of  Varanini  et  al .  are  ar¬ 
guably  the  best  of  their  kind  at  a  state  level,  they  are  no  subst itute  for  the 
more  comprehensive  view  of  energy  resilience  proposed  in  this  study.  They  can, 
however,  help  to  provide  a  framework  for  political  leadership  to  encourage  and 
coordinate  local  actions  that  would  most  quickly  accomplish  that  shift.  It  is 
therefore  especially  unfortunate  that  the  same  Federal  budget  cuts  which  crippled 
many  local  energy  programs  are  also  likely  to  lead  to  the  dismantling,  during 
1981-82,  of  most  of  the  state  energy  offices.  In  the  absence  of  such  proposed 
substitutes  as  the  Energy  Management  Partnership  Act  (which  was  not  enacted), 
much  of  the  present  capability  for  coordinating  state  energy  preparedness  meas¬ 
ures  [Energy  Consumer  1980b :32-45]  is  slated  to  disappear.  Such  state  efforts, 
like  corresponding  ones  at  county  and  municipal  scale  (e.g.  in  Los  Angeles), 
should  on  the  contrary  be  strengthened  as  the  most  cost-effective  way  to  achieve 
local  goals  which  in  aggregate  add  up  to  national  energy  preparedness. 
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Federal  rhetorical  support  for  cost-effective  efficiency  improvements  and 
appropriate  renewable  sources  is  nowadays  abundant.  Disagreements  over  their 
role  are  generally  questions  of  degree.  The  Canadian  Government's  strategy 
paper  [EMR  1980:65],  for  example,  states  that 

The  realities  of  the  energy  future  indicate  the  wisdom  of  accelerated 
efforts  to  develop  new  and  renewable  energy  forms ... .While  mast  conven¬ 
tional  forecasts  imply  a  relatively  modest  role  for  renewables,  it  is 
clear  that  many  Canadians  do  not  share  that  view.  Indeed,  the  dramatic 
surge  in  the  use  of  [ fuel ] wood. .. suggest s  that  these  forecasts  understate 
substantially  the  contribution  to  be  made.  Moreover,  while  forecasts  are 
useful  tools  for  analysis,  they  can  tell  us  only  what  will  happen  under 
certain  conditions.  The  conditions — the  policies — are  the  keys.  Many 
thoughtful  and  concerned  Canadians  believe  that  we  should  alter  the  fore¬ 
cast,  that  we  should  decide  soon  on  a  preferred  energy  future,  and  estab¬ 
lish  the  conditions  that  will  take  us  there.  The  National  Energy  Program 
envisages  a  much  greater  role  for  renewable  energy.  The  Government  of 
Canada  believes  that  economic  realities  now  favour  a  range  of  renewable 
energy  options. 

U.S.  policy  places  greater  stress  on  allowing  the  renewable  share  to  be  deter¬ 
mined  by  the  marketplace  rather  than  by  social  planning,  and  the  previous  Admin¬ 
istration's  goal  of  20%  renewable  supply  by  the  year  2000  has  been  formally 
abandoned  (current  DOE  estimates  are  under  10% — a  share  only  a  third  larger 
than  today).  Many  of  the  substantive  enbodiments  of  previous  bipartisan 
commitments  to  accelerating  efficiency  and  renewable  technologies  have  also 
been  diluted  or  reversed.  Nevertheless,  the  general  tone  is  guardedly 
supportive  [DOE  1981a:9]: 

Most  ' renewab les ' . . . have  little  or  no  public  opposition;  nor  do  they  pose 
severe  long-term  environmental  problems.  Thus,  they  are  well  suited  (and 
may  be  confined)  to  any  specific  regional  markets  where  they  make  economic 
sense.  The  Administration's  clear  and  consistent  adherence  to  free-market 
principles  will  remove  artificial  barriers  and  provide  a  major  impetus  to 
the  development  of  such  technologies. 

In  giving  practical  effect  to  such  generalities,  however,  we  recommend  several 
shifts  of  emphasis,  or  correction  of  omissions,  which  would  help  Federal  agen¬ 
cies  to  improve  energy  preparedness. 

First,  and  perhaps  most  in^ortant,  is  to  reflect  in  Federal  energy  think¬ 
ing  the  comprehensive  approach  to  vulnerability  and  resilience  which  the  fore¬ 
going  analysis  has  developed.  This  has  not  been  done  since  at  least  World  War 
11  (if  then) — even  under  such  Secretaries  as  James  Schlesinger,  whose  D0D/C1A 
background  might  have  been  expected  to  heighten  his  sensitivity  to  such  issues. 
DOE's  desire  for  a  "resilient"  energy  policy  [1981a:l]  needs  to  consider  a  far 
wider  range  of  disruptions  than  interruptions  in  oil  supply — the  traditional 
and  continuing  emphasis  [ :  2  ] .  Responses  to  vulnerability  need  to  be  broadened 
far  beyond  stockpiling,  encouraging  dual-fueling  of  certain  oil-using  devices, 
developing  surge  capacity,  and  international  liaison  [:  13-14]. 

Currently,  a  few  Federal  programs  do  reflect  specific  security  concerns. 

The  Strategic  Petroleum  Reserve,  for  exanple,  has  benefited  from  vulnerability 
analyses  (albeit  without  encouragement  from  DOE  or  much  coordination  with 
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FEMA);  there  are  minor  utility  programs  concerned  with  the  integrity  of  region¬ 
al  grids  and  with  traditional  studies  of  technical  reliability;  and  there  are 
site-  and  program-specific  nuclear  security  analyses .  Yet  the  concerns  of  all 
these  programs  are  akin  to,  and  somewhat  narrower  than,  those  raised  in  Chapter 
3.  They  do  not  yet  reflect  this  study's  broader  approach  to  systematically 
achieving  energy  resilience.  The  potential  contribution  of  end-use  efficiency 
and  appropriate  renewable  sources  in  enhancing  national  security — especially  in 
minimizing  the  consequences  of  terrorist  attacks — is  thus  not  being  properly 
exploited  because  it  is  not  fully  perceived. 

Second,  the  Administration's  free-market  philosophy  is  long  overdue  and 
can  produce  immense  benefits  in  efficient  energy  investment,  but  is  not  yet  be¬ 
ing  consistently  applied  [Lovins  &  Lovins  1980a],  The  resulting  market  distor¬ 
tions  impede  the  use  of  resilient  technologies.  When  the  Assistant  Secretary 
for  Fossil  Energy  remarked  (as  reported  in  the  8  October  1981  Oil  Daily)  that 
without  the  $1. 5-bill  ion  Federal  loan  guarantee  to  Tosco,  even  its  partner  Exxon 
might  pull  out  of  a  vast  Colorado  oil-shale  project,  that  was  tantamount  to  an 
admission  that  shale  oil  cannot  compete  in  a  free  market.  If  so,  it  hardly  de¬ 
serves  Federal  support;  conversely,  if  it  can  compete,  it  does  not  need  support 
— the  same  approach  being  applied  to  efficiency  and  most  renewAles,  which  can 
hold  their  own  in  fair  competition  but  perhaps  not  against  things  like  sub s i- 
d * ze<*  oil  shale,  conventional  oil,  Alaskan  gas,  and  central-station  electricity. 

From  a  preparedness  perspective  it  is  regrettable  that  recent  budget 
shifts  have  tended  to  maintain  or  increase  support  to  the  costliest,  most  vul¬ 
nerable,  and  moat  heavily  subsidized  technologies  while  reducing  support  to  the 
cheapest,  least  vulnerable,  and  least  heavily  subsidized.  Eliminating  all  the 
subsidies  would  be  better.  Meanwhile,  compensatory  programs  (such  as  the  Con¬ 
servation  and  Solar  Bank)  to  help  the  most  vulnerable  menbers  of  society 
achieve  energy  self-reliance  deserve  support.  So  do  cost-effective  Federal 
non-subsidy  programs  to  speed  the  refinement  and  use  of  the  most  resilient 
technologies.  A  sampling  of  such  opportunit ies — many  already  endorsed  by  DOE's 
Energy  Research  Advisory  Board — includes  industrial  efficiency  programs, 
appliance  efficiency  labelling  and  a  wide  range  of  other  consumer  information 
programs,  analysis  of  institutional  barriers  to  least-cost  investments,  the 
inplementat ion  studies  and  programs  of  the  Solar  Energy  Research  Institute  and 
its  regional  branches  (including,  for  example,  research  into  the  behavioral 
determinants  of  energy  use  [ERAB  1981:6]),  and  R&D  into  second-generation  photo- 
voltaics.  The  last  of  these  is,  like  refrigerators,  a  prime  example  of  a  vast 
market  likely  to  be  captured  by  Japan  if  U.S.  industry  concentrates  mainly — as 
it  would  tend  to  do  if  not  helped  to  take  a  longer  view — on  first-generation 
technologies  soon  to  be  rendered  obsolete. 


Third,  in  order  to  make  policy  more  coherent  and  direct  it  more  towards 
achieving  energy  resilience  as  soon  as  possible,  far  greater  efforts  are  needed 
to  ensure  the  conditions  that  enable  the  marketplace  to  work  efficiently.  Price 
deregulation  will  indeed  provide  [DOE  1981a]  even  greater  incent ive  for  energy 
efficiency  and  renewables.  But  failure  to  remove  market  inperfections  will 
result  in  a  frustrating  and  persistent  lack  of  opportunity  to  respond  to  price 
signals.  For  example,  vigorous  enforcement  and  strengthening  of  the  Public 
Utility  Regulatory  Policies  Act  of  1978,  which  seeks  to  replace  restrictive 
utility  practices  with  a  competitive  market  in  generation,  is  the  best  single 
way  to  encourage  entrepreneurial  programs  of  dispersed  electric  generation. 

Yet  the  Federal  Energy  Regulatory  Commission,  rather  than  encouraging  states  to 
set  full  avoided-cost  buyback  rates,  is  overlooking  derisory  rates  and  defend¬ 
ing  the  Act  only  weakly  from  legal  and  political  attack  by  special  interests 
that  do  not  want  to  be  exposed  to  competition.  FERC  is  also  rapidly  increasing 
subsidies  to  central-station  generation — effectively  locking  up  money  which,  in 
an  efficient  capital  marketplace,  would  go  to  cheaper  and  more  resilient  alter¬ 
natives,  greatly  improving  utilities'  financial  integrity  (Appendix  A).  Like¬ 
wise,  most  Federal  programs  to  help  states  and  localities  to  modernize  their 
building  codes,  provide  information  on  cost-effective  technologies,  and  other¬ 
wise  remove  barriers  to  least-cost  investment  are  being  removed  from  the 
Federal  agenda  with  little  substitute  in  sight.  The  resulting  Federal  energy 
policy  is  not  consistent  with  FEMA' s  preparedness  objectives. 

Fourth,  renewable  and  efficiency-raising  technologies  are  evolving  extreme¬ 
ly  rapidly.  Some  key  technical  issues  require  analysis  and  Federal  policy 
action  immediately — such  as  the  preparedness  aspects  of  grid  integration  (pp. 
226-228)  and  the  encouragement  of  multifuel  capability  in  cars  (p.  242).  With¬ 
out  proper  handling  of  these  issues,  many  of  the  potential  preparedness  bene¬ 
fits  of  spontaneous  efficiency  and  renew^sles  programs  will  not  be  realized. 

The  few  analytic  groups  that  had  begun  to  consider  such  questions,  notably  at 
the  Solar  Energy  Research  Institute,  have  been  disbanded,  and  the  private 
sector  has  no  incentive  to  take  their  place. 

More  broadly,  the  patterns  and  processes  of  Federal  thinking  about  energy 
need  to  be  leavened  by  a  greater  awareness  of  the  nature  of  vulnerability  and 
how  to  confoat  it.  The  best  Federal  energy  preparedness  planning  today  appears 
to  be  in  the  Department  of  Defense — as  exenplified  by  impressive  retrofit  and 
renewables  programs  at  some  military  bases — but  the  details  and  rationale  of 
this  work  are  not  well  known  to  civilians,  even  in  the  Department  of  Energy. 

DOD  proposed  some  years  ago  to  have  a  liaison  in  the  office  of  the  Secretary  of 
Energy  to  ensure  that  vulnerability  got  proper  attention;  but  this  was  never 
done,  and  over  the  years,  diverse  DOE  managers  have  continued,  incrementally 
and  unknowingly,  to  increase  the  vulnerability  of  America's  energy  system. 
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There  is  a  similar  opportunity  to  strengthen  coordination  between  FEMA, 

DOE,  and  Interior  to  ensure  that  the  concerns  which  are  FEMA's  statutory  ] 

responsibility  receive  due  weight  in,  and  are  not  undercut  by,  other  agencies' 
decisions  taken  on  other  grounds.  It  would  also  be  worthwhile  to  improve 
liaison  with  those  menbers  of  Congress  who  have  shown  particular  expertise  and 
interest  in  energy  resilience  (as  in  Senator  Percy's  study  of  a  possible 
National  Defense  Alcohol  Fuel  Reserve).  Currently,  whether  in  the  Executive  or 
the  Legislative  branch,  Federal  programs  and  plans  which  affect  energy 
vulnerability — in  either  direction — tend  to  be  specialized,  scattered,  and 
uncoordinated .  It  is  understandable  that  FEMA  should  be  somewhat  preoccupied 
by  such  complex  and  specific  responsibilities  such  as  nuclear  evacuation  plans 
and  post-attack  planning.  But  someone — if  not  FEMA,  then  some  other  expert 
agency — must  begin  to  consider  the  nuch  broader  canvas  of  planning  for  resili¬ 
ence  which  this  study  describes*. 

In  summary:  our  consideration  of  energy  preparedness,  and  our  experience 
with  hundreds  of  local  and  regional  energy  efforts  around  the  country,  leads  us 
to  conclude  that  the  most  fruitful  roles  for  an  agency  like  FEMA  in  promoting 
energy  preparedness  would  be  to  raise  the  consciousness,  expertise,  and  public 

accountability  of  those  Federal  agencies  whose  decisions  are  increasing  energy  t 

vulnerability;  to  identify  and  coordinate  Federal  action  on  those  detailed  gaps 
in  Federal  pLanning  which  we  have  identified  (such  as  grid  integrat ion) ;  and  to 


♦Indeed,  we  hope  FEMA  will  apply  to  many  other  areas  of  national  vulnera¬ 
bility  the  style  of  analysis  we  use  here.  The  production  and  distribution  of 
food  is  an  obvious  case:  supply  lines  are  currently  so  long  that  a  truckers' 
strike  or  bad  weather  can  put  many  retail  food  stores,  especially  in  the  East, 
on  short  rations  in  a  matter  of  days.  The  reasons  for  this  vulnerability  are 
much  the  same  (long  supply  lines,  tight  coupling,  etc.)  as  those  we  identified 
for  the  energy  system  in  Chapter  2.1,  and  potential  remedies  are  also  largely 
analogous.  The  promotion  of  greater  self-reliance  in  food  production  as  be¬ 
tween  regions  of  the  country  and  between  urban  and  rural  areas  could  clearly 
make  important  contributions  to  national  preparedness.  In  some  instances, 
such  as  Alaska,  such  essential  self-reliance  used  to  exist  but  was  systemati¬ 
cally  dismantled  in  the  1950s  and  1960s  in  order  to  produce  commercially  re¬ 
warding  dependence  on  a  long  supply  line  (in  that  case  from  Seattle).  A  few 
weeks'  shipping  strike  in  Seattle  today  would  bring  Alaska  near  to  starvation; 
yet  Alaska  can  easily  be  a  net  exporter  of  food,  and  holds  many  national  rec¬ 
ords  for  vegetable  growing.  The  Joint  Committee  on  Defense  Production  [1977: 
11:42-45)  found  that  similar  considerations  apply  to  American  industry,  whose 
character is ics  are  tailor-made  for  easy  disruption.  The  Committee  found  that 
correcting  these  defects,  even  at  the  margin  and  over  many  decades,  could  be 
very  costly.  But  the  cost  of  not  doing  so  could  be  even  higher — a  rapid  re¬ 
gression  of  tens  or  even  hundreds  of  years  in  the  evolution  of  the  American 
economy,  should  it  be  suddenly  and  gravely  disrupted.  A  third  area  where  it 
would  be  important  to  apply  a  similar  analysis  is  water  policy — currently  in 
the  state  of  looming  crisis  that  energy  was  in  in  the  1960s,  and  for  striking¬ 
ly  similar  reasons.  Whether  perceived  or  not,  the  true  implications  of  these 
and  other  vulnerabilities  will  inexorably  be  borne  in  upon  us  by  a  surprise- 
full  future.  Energy  policy  is  only  the  first  of  many  choices  between  resili¬ 
ence  and  collapse. 
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use  its  influence  and  resources  to  spread  information  on  the  specifics  of 
achieving  greater  energy  resilience,  especially  by  encouraging  locally  based 
energy  mobilizations"  addressed  to  local  security  and  economic  concerns.  Dis¬ 
tributing  instructions  on  how  to  use  a  truck  as  an  improvised  electric  genera¬ 
tor  [e.g.  DCPA  1977:App.G)  is  useful  if  all  else  has  failed.  But  distributing 
instructions  on  how  to  make  buildings  and  factories  efficient,  how  to  harness 
renewable  sources  in  the  service  of  energy  preparedness,  how  to  improvise 
efficiency  and  renewable  technologies  out  of  locally  available  materials,  and 
how  to  integrate  new  energy  devices  in  the  way  most  supportive  of  preparedness 
goals  would  fill  an  information  gap  which  no  other  actor  is  likely  to  fill — and 
be  the  best  insurance  against  ever  having  to  hook  up  that  truck  generator. 

A  useful  first  step  would  be  for  FEMA  to  serve  as  a  visible  focus  for 
Federal  efforts  at  energy  preparedness,  helping  DOE  to  coordinate  its  efforts 
to  ensure  that  day-to-day  decisions  serve  to  increase,  not  reduce,  energy 
resilience.  But  to  go  further — to  offer  Americans  the  informational  tools  they 
need  to  turn  from  managing  curtailments  to  prevent ing  curtailments — would  be  a 
far  greater  step,  and  one  better  fulfilling  FEMA1 s  broader  mission:  to  help 
build  a  nation  in  which  emergencies  needing  management  are  unlikely  to  arise. 

Today  our  nation  uses  an  energy  system  so  brittle  that  major  energy  emer¬ 
gencies  are  not  only  possible  but  expected.  If  FEMA  harnesses  the  latent  in¬ 
genuity  and  commitment  of  millions  of  citizens  who  are  concerned  about  this 
vulnerability,  and  who  wish — in  both  their  own  and  the  national  interest — to 
build  a  more  secure  and  stable  energy  future,  the  changes  already  underway  in 
America's  energy  system  can,  we  believe,  be  greatly  smoothed  and  speeded.  This 
will  require  sensitivity  to  local  needs,  and  a  philosophy  of  encouraging  grass¬ 
roots  initiatives  rather  than  imposing  requirements.  But  if  it  is  done,  the 
reward  will  be  a  sustainable  foundation  for  national  prosperity,  an  energy 
system  that  contributes  to  that  prosperity  rather  than  sapping  it,  and  a 
tangible  basis  for  regaining  a  sense  of  security  in  our  lives  and  freedoms. 

★  *  * 
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APPENDIX  A:  RISKS  TO  THE  SOLVENCY  OF  ELECTRIC  UTILITIES 


[This  Appendix  is  in  the  form  of  an  unsolicited  memorandum,  sent  by  A.B. 
Lovins  on  26  February  1981  to  the  Secretaries  of  the  Treasury  and  Com¬ 
merce,  the  Director  of  Management  and  Budget,  other  government  officials, 
several  members  of  Congress,  members  of  the  financial  and  academic  com¬ 
munities  concerned  with  utility  issues,  and  utility  executives  and  regu¬ 
lators.  As  of  mid-May  1981,  responses  had  been  received — all  favorable — 
only  from  the  non-governmental  recipients.  A  slightly  edited  version 
is  to  be  published  in  The  Energy  Journal  (international  Association  of 
Energy  Economists)  later  in  1981.  The  memorandum,  originally  entitled 
"How  To  Keep  Electric  Utilities  Solvent,"  follows  in  full:) 


An  urgent  policy  issue  likely  to  confront  you  this  year  or  next  is  how  to 
keep  one  or  more  major  U.S.  investor — owned  utilities  [_1_]  from  becoming 
visibly  bankrupt.  The  fiscal  and  psychological  fallout  could  be  severe, 
because  vast  amounts  of  utility  debt  and  equity  are  built  into  the  base 
of  our  nation's  highly  leveraged  capital  structure.  If  confidence  in  the 
worth  of  those  assets  were  eroded  by  something  worse  than  ConEd's  divi¬ 
dend  omission  seven  years  ago,  there  could  be  disproportionate  and  un¬ 
manageable  effects  on  banks,  insurance  companies,  and  pension  funds.  At 
least  one  regional  Fed  office  is  already  worrying  about  how  to  bail  out 
some  local  banks  that  are  up  to  their  necks  in  dubious  utility  paper. 

During  the  past  few  years  I  have  wotked  with  many  utility  executives, 
bankers,  and  regulators  to  try  to  restore  utilities  to  financial  integ¬ 
rity  through  a  better  understanding  of  their  predicament.  From  this 
perspective  I  am  concerned  that  the  reflex  actions  most  likely  to  be 
proposed  to  you  in  a  crisis  are  liable  to  make  the  utilities  worse  off 
and  thus  to  increase  financial  risks  to  an  even  more  intractable  level. 

The  conventional  wisdom  of  the  industry  and,  until  recently,  of  most 
financial  analysts  holds  that  the  utilities  would  be  healthy  but  for  an 
unfavorable  regulatory  climate  that  gives  them  (belatedly)  only  half  the 
rate  relief  they  want.  In  this  view,  if  the  utilities  were  unregulated 
or  at  least  more  sympathetically  regulated,  they  would  be  commercially 
viable  enterprises.  I  believe  this  view  is  false  for  three  reasons: 

1.  Utility  cash-flow  is  inherent  1 y  unstable  —  to  the  point  that  any 
utility,  whether  regulated  badly,  perfectly,  or  not  at  all,  will  go  broke 
if  it  keeps  building  power  stations. 

2.  Long-run  price  elasticity  of  revenue  may  be  negat i ve — in  which 
case  construction,  by  incurring  higher  marginal  costs,  would  require 
higher  revenues  to  maintain  it  but  would  produce  lower  revenues. 

3.  The  utilities'  financial  problem  is  not  merely  fiscal  but  also 
fundamentally  economic:  all  of  their  marginal  output  and  much  of  their 
current  output  is  simply  uncompetitive  in  an  end-users'  market. 

Let  me  now  briefly  argue  for  each  of  these  propositions,  leaving  the 
details  for  cited  references  and,  if  you  wish,  for  discussion. 


1.  Many  public  utilities  have  ana'ogous  problems.  See  e.g.  Washington 
State  Senate  Energy  &  Utilities  Committee,  WPPSS  Inquiry  Report,  1981: 
the  $5.5  billion  in  bonds  sold,  part  of  the  largest  non-federal  public 
borrowing  program  in  the  U.S.,  have  already  incurred  carrying  charges 
totalling  >$46  billion  in  current  dollars;  yet  far  more  money  is  needed 
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1.  Utility  cash-flow  is  inherently  unstable  [_2l  . 

Electric  utilities  are  extraordinarily  capital-intensive — about  a  hundred 
times  as  much  as  the  traditional  direct-fuel  energy  systems  on  which  the 
American  economy  was  built.  Owing  to  the  scale  and  complexity  of  the 
technologies,  construction  lead  times  for  traditional  major  utility 
investments  are  irreducibly  several  times  longer  than  the  time  constant 
for  short-run  price  elasticity  of  demand.  Accordingly,  a  utility  that 
orders  a  power  plant  will  inevitably  overbuild.  Higher  marginal  costs 
require  higher  prices  to  maintain  financial  health  during  construction. 
These  higher  prices  dampen  demand  growth  below  the  expected  level;  thus 
when  the  plant  is  commissioned,  demand  and  hence  revenues  are  inadequate 
to  cover  fixed  charges.  This  shortfall  induces  still  higher  prices, 
dampening  demand  growth — or,  in  some  cases,  the  level  of  demand — still 
further,  thus  increasing  overcapacity  and  eroding  cash-flow  still  more. 

If  demand  at  the  time  of  plant  completion  falls  persistently  short  of 
expectations,  cash-flow  will  progressively  collapse. 

So  far  into  this  "spiral  of  impossibility"  are  U.S.  utilities  that  if 
every  power-plant  construction  project  in  the  country  were  cancelled  now, 
and  if  we  had  for  the  rest  of  the  century  twice  the  rate  of  peak  demand 
growth  we  had  in  1979  (a  "normal"  year  with  3.2%  real  GNP  growth),  then 
in  2000,  we  would  still  have  nationally — ignoring  significant  regional 
differences — a  prudent  15%  reserve  margin,  just  by  working  off  the  fat. 

(This  does  not  count  price- induced  acceleration  of  improvements  in  elec¬ 

trical  productivity,  nor  200+  GWe  of  available  cogeneration,  nor  other 
alternatives.)  This  overcapacity  has  built  up  through  demand  forecasts 
so  exaggerated  that  during  1974-79,  investor-owned  utilities'  forecasts 
of  peak  demand  one  year  ahead  averaged  2.6  times  the  actual  growth.  Had 
the  utilities  enjoyed  perfect  information  about  cash  needs  and  price  ela¬ 
sticity  a  decade  ahead,  they  could  in  principle  have  avoided  overshoot. 
But  data  and  forecasting  tools  are  grossly  unequal  to  this  task,  and  in 

practice,  most  utilities  predicted  demand  based  on  current  or  rolled-in 

prices,  very  low  price  elasticity,  and  underestimated  cash  requirements. 

Many  second-order  effects  make  the  instability  worse,  including  some  act¬ 
ing  through  capital  markets  and  accounting  methods.  Utilities'  reliance 
on  Allowance  for  Funds  Used  During  Construction  (a  fictitious,  non-cash 
income  item  now  constituting  about  half  their  net  income)  makes  cash-flow 
collapse  faster  if  in  fact  the  construction  is  not  finished  or  if  its 
output  cannot  be  sold:  the  real  cash  position,  not  its  AFUDC-boosted 
facade,  then  becomes  apparent.  The  possibility,  based  on  several  recent 
precedents,  that  state  Commissions  may  exclude  unneeded  plant  completions 
from  rate  base  also  heightens  the  risk  of  not  being  made  whole. 

Would  commonly  proposed  measures  to  boost  cash-flow  correct  its  instabil¬ 
ity?  No.  For  example,  putting  construction  work  in  progress  (CWIP)  into 
the  rate  base  gives  price  elasticity  longer  to  work  during  construction 
--it  approximates  a  sort  of  marginal-cost  pricing  up  front — and  thus 
increases  the  shortfall  in  revenue  when  the  plant  is  completed.  (An 
alert  utility  which  anticipated  this  could  of  course  cancel  the  construc¬ 
tion,  but  then  there'd  be  no  CWIP  to  argue  about.)  Rate-based  CWIP  is 
economically  dubious  because  it  makes  ratepayers  finance  compulsorily  an 
investment  which  investors  are  unwilling  to  finance  themselves.  But 
besides  evading  the  salutary  discipline  of  the  cap.^al  marketplace,  it  is 
not  even  in  the  utilities'  long-term  interest  because  it  would  ultimately 
only  increase  overcapacity. 

T"  This  argument  is  expanded  and  documented  in  my  March  1979  E.F.  Hutton 
•nf^renre  paper  "Electric  Utility  Investments:  Excelsior  or  Confetti?", 
•►•printed  Spring  1981  in  J.  Bus.  Admin.  12(2)  [VancouverJ  . 
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What  about  increased  subsidies — faster  depreciation,  bigger  investment  ] 

tax  credit,  mandatory  phantom  taxes  in  flow-through  states,  etc.?  These  3 

would  further  inflate  the  utilities'  construction  beyond  their  ability  to  ] 

amortize  it  from  revenues,  making  them  crash  harder  just  a  few  years  j 

later.  Indeed,  present  tax  subsidies  and  rolled-in  pricing  can  in  sig-  > 

nif icant  part  be  blamed  for  having  led  the  utilities  down  the  path  to  ! 

ruin.  Each  of  these  terms  reduces  the  marginal  delivered  price  by  about 
1 . 5-2^/kW-h .  Thus,  conservatively  assuming  unitary  price  elasticity, 
demand  at  the  margin  is  being  roughly  doubled  from  an  economically  effi¬ 
cient  level  (clearing  at  the  shadow  price);  or,  to  put  it  differently, 
utilities  are  led  to  overinvest  in  supply,  as  against  increased  energy 
productivity,  by  about  twofold — a  mi sa 1 1  oca t i on  of  over  $100  billion. 

In  short,  a  disparity  of  time  constants  between  contruction  and  price 
response  makes  cash-flow  unstable — the  classic  control-theory  instability 
of  any  system  with  long  lags.  Reconciling  the  two  time  constants  can 
cure  the  instability,  but  subsidies  make  it  worse.  It  is  like  having  a 
furnace  controlled  by  a  thermostat  at  the  end  of  a  long  corridor:  the 
corridor  will  overheat  before  the  thermostat  can  tell  the  furnace  to  shut 
off.  Moving  the  thermostat  up  next  to  the  furnace  reduces  the  time-lag 
and  can  eliminate  the  overshoot.  Turning  up  the  thermostat  or  enlarging 
the  furnace  merely  exacerbates  it. 


2.  Higher  prices  may  reduce  long-run  revenues. 

Both  recent  observations  of  empirical  marketplace  behavior  and  detailed 
new  engineering/economic  studies  of  the  scope  for  using  electricity  more 
efficiently  (see  #3  below)  have  led  many  analysts  of  energy  demand  to 
suspect  that  clearance  of  institutional  barriers  to  efficient  investment 
will  elicit  long-run  price  elasticities  of  demand  for  electricity  of  at 
least  -1.0  and  probably  more:  -1.5  is  reasonable  and  even  -2.0  is  not 
impossible.  If  the  absolute  value  of  the  elasticity  exceeds  one,  then 
absent  compensatory  growth  in  population  or  income,  price  elasticity  of 
revenue  is  negative.  Higher  prices  would  then  lose  the  utility  more  on 
the  number  of  kilowatt-hours  it  sold  than  it  would  make  up  by  charging 
more  for  each  kilowatt-hour.  Nobody  knows  yet  whether  this  is  the  case, 
but  if  it  were,  a  rational  utility  seeking  higher  revenues  should  reduce 
its  rates  and  its  rate  base. 

When  marginal  costs  started  to  exceed  historic  costs,  around  1970,  it 
took  many  utilities  ten  years  to  realize  that  building  more  plants  is  not 
in  their  economic  interest:  they  never  get  their  money  back.  It  may  now 
take  some  utilities  another  decade  to  realize  that  rate  relief  is  not  a 
panacea  and  may  even  dig  them  into  a  deeper  hole. 


3.  Utilities'  product  is  basically  uncompetitive. 

There  is  no  demand  for  electr i city  per  se .  Raw  kilowatt-hours  are  not  a 
useful  commodity.  The  real  demand  is  for  energy  services:  comfort, 
light,  mobility,  ability  to  smelt  alumina  or  run  sewing-mach ines .  End- 
users  desiring  these  services  have  a  wide  choice  of  how  to  provide  them: 
raising  their  energy  productivity,  buying  electricity,  or  buying  some 
other  form  of  energy.  In  a  free  market,  end-users  can  be  expected  to 
choose  the  amount,  type,  and  source  of  energy  that  will  provide  each  de¬ 
sired  service  as  lowest  private  internal  cost.  This  will  often  mean  buy¬ 
ing  less  electricity — precisely  what  many  consumers  are  starting  to  do. 


Electricity  is  a  special,  high-quality,  extremely  expensive  form  of  ener¬ 
gy.  Today's  average  delivered  price,  around  5^/kW-h,  is  equivalent  to 
buying  the  heat  content  of  oil  priced  at  $80/bbl.  A  typical  marginal 
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delivered  price,  8$/kW-h  in  1980  $,  is  equivalent  on  a  heat  basis  to  buy¬ 
ing  oil  at  $130/bbl,  four  times  today's  OPEC  oil  price.  Such  expensive 
energy  may  be  worthwhile  for  certain  premium  applications  such  as  smel¬ 
ters,  lights,  motors,  appliances,  and  subways.  It  is,  however,  funda¬ 
mentally  uneconomic  for  thermal  applications,  even  if  used  in  a  very  ef¬ 
ficient  heat  pump.  It  also  cannot  compete  in  the  road-vehicle  market 
against  really  efficient  fueled  cars,  especially  series  hybrids.  These 
economic  conclusions  are  robust  and  not  vulnerable  to  technical  change. 

The  end-use  energy  requirements  of  the  U.S.  economy  are  currently: 


heat  (mainly  at  low  temperatures) . 58% 

vehicular  liquid  fuels . 34% 

electricity- specific  appl  i  cat  ions . .  8% 


TOTAL  DELIVERED  ENERGY  NEEDS .  .Tool 

Only  8%,  then,  of  all  delivered  energy  requires  and  (at  marginal  price) 
can  economically  justify  electricity;  but  13%  of  all  delivered  energy  is 
currently  supplied  in  the  form  of  electricity,  and  16%  would  be  if  plants 
were  not  sitting  idle.  Thus  the  real  electrical  market  is  already  filled 
up  twice  over  by  today's  power  stations.  Two-fifths  of  all  U.S.  electri¬ 
city  sold  is  already  being  used  uneconomical ly  for  low- temperature  heat¬ 
ing  and  cooling:  space  heating,  water  heating,  and  air  conditioning. 

Still  more  could  only  be  so  used — like  cutting  butter  with  a  chainsaw. 

There  is  thus  no  marginal  market  for  electricity  in  the  United  States, 
because  the  premium  applications  for  this  costly  form  of  energy  are 
already  saturated.  Arguing  about  which  kind  of  power  station  to  buy  is 
somewhat  like  shopping  for  the  best  buy  in  brandy  to  burn  in  your  car,  or 
the  best  buy  in  Chippendales  to  burn  in  your  stove.  It  does  not  matter 
whether  one  kind  of  proposed  new  power  station  will  be  able  to  provide 
cheaper  kilowatt-hours  than  another  kind,  because  no  kind  of  new  power 
station  can  come  clo9e  to  competing  with  the  real  competitors — the  cheap¬ 
est  ways  to  provide  the  same  energy  services.  Those  real  competitors, 
equally  available  to  end-users,  are  such  measures  as  weatherstripping, 
insulation,  heat  exchangers,  window  shades,  and  greenhouses.  They  can 
provide  the  user  with  heating  or  cooling  not  at  the  8$  it  would  cost  with 
marginal  electricity  (3-4$  with  a  good  heat  pump),  but  rather  at  about 
0 .4$/kW-h .  No  thermal  power  station,  new  or  old,  can  compete  with  that. 

This  finding  has  been  confirmed  in  detail  by  Roger  Sant  in  his  study  of 
"The  Least-Cost  Energy  Strategy"  [_3 ]  .  He  showed  that  at  rolled-in  1978 
prices,  some  43%  of  the  electricity  sold  in  the  U.S.  was  uncompetitive 
with  efficiency  improvements  that  would  provide  consumers  with  the  same 
energy  services  at  lower  cost.  What  would  happen,  however,  if  we  made 
this  comparison  at  marginal  delivered  prices — as  we  should  do  to  minimize 
social  cost?  My  analysis,  not  to  Sant's  surprise,  suggests  that  the 
electricity  saving  would  then  be  so  large  that  al 1  of  the  thermally 
generated  electricity  in  the  country  may  become  uncompetitive! 

This  is  mainly  because  there  is  an  enormous  scope,  just  now  starting  to 
be  appreciated,  for  raising  the  energy  productivity  of  non-thermal  uses 
of  electricity  through  cost-effective  technical  measures.  For  example, 
lighting  efficiency  can  typically  be  trebled,  at  a  price  under  0.5$/kW-h, 
by  task-lighting,  daylighting,  and  efficient  lights  and  fixtures.  The 
practical  efficiency  of  industrial  electric  motors  can  generally  be 
doubled  by  proper  sizing,  coupling,  and  controls,  at  a  cost  often  below 
0.8$/kW-h — a  payback  of  3-4  years.  (Just  this  one  saving  would  more  than 

_3.  Energy  Productivity  Center,  Mellon  Institute  (Suite  1200,  1925  N. 

Lynn  St.,  Arlington  VA  22209;  Harv.  Bus.  Rev.  6&ff,  May-June  1980.  My 
analysis  is  documented  in  Energy/War  Iref.  b)  at  pr  47-53  and  96-100. 
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displace  the  entire  U.S.  nuclear  power  program.)  Intelligent  redesign 
costing  1.1^/kW-h  (6-year  payback  at  5i/kW-h)  can  quadruple  the  average 
efficiency  of  household  appliances  with  no  loss  of  convenience.  Other 
such  examples  abound.  It  is  for  this  reason  that  Sant's  latest  analysis, 
constructing  from  many  hundreds  of  sectors  a  "least-cost  strategy"  for 
providing  energy  services  in  the  year  2000,  finds  it  is  seldom  worthwhile 
even  to  finish  building  the  power  stations  now  under  construct  ion . 

Further  confirmation  comes  from  an  analysis  commissioned  by  John  Sawhill 
in  1979  from  consultants  directed  by  Henry  Kelly  at  the  Solar  Energy 
Research  Institute.  They  explored  U.S.  energy  needs  if  real  GNP  were  to 
increase  by  two-thirds  during  1980-2000,  assuming  that  energy  investments 
were  meanwhile  based  on  least  marginal  cost  to  the  consumer  and  were 
neutral  as  between  increasing  supply  and  increasing  efficiency.  The 
result  was  a  total  primary  energy  demand  in  2000  reduced  by  at  least  a 
quarter  below  today's  level,  a  total  nonrenewable  fuel  requirement  cut  by 
nearly  half,  and  a  flat  or  declining  total  demand  for  electricity.  Even 
the  presently  installed  coal  and  hydro  plants  provided  more  electricity 
than  careful  analysis  could  find  an  economically  rational  use  for.  This 
implies,  as  Sant's  most  recent  work  has  found  explicitly,  that  total  U.S. 
energy  costs  as  a  fraction  of  GNP  could  actually  decline.  The  energy 
sector,  far  from  driving  inflation,  would  become  a  net  exporter  of 
capital  to  the  rest  of  the  economy.  Increased  energy  productivity  would 
become  a  principal  engine  of  economic  growth. 

This  is  good  news  for  the  economy  as  a  whole,  but  it  is  bad  news  for 
utilities,  for  it  means  that  they  have  over  $100  billion  worth  of  thermal 
plants  which  they  may  be  unable  to  amortize.  Utilities  must  now  compete 
not  only  with  efficiency  improvements,  but  also  with  alternative  genera¬ 
tion  options  from  which,  under  the  Public  Utility  Regulatory  Policies  Act 
of  1978  (PURPA),  they  must  buy  back  surplus  power  at  their  own  "avoided 
cost" — in  oil-burning  New  Hampshire,  7 . 7-8 .2^/kW-h .  Entrepreneurs  are 
therefore  installing  dispersed  generation  whose  output  is  to  be  profit¬ 
ably  sold  to  still  other  entrepreneurs  who  in  turn  profitably  sell  it 
back  to  utilities.  What  are  these  alternative  options  with  which  exis¬ 
ting  thermal  plants  must  compete?  A  utility  seeking  more  electricity  can 
get  it  from  these  sources,  in  approximate  order  of  increasing  price: 

a.  Eliminate  pure  waste  of  electricity,  like  lighting  empty  offices 
at  headache  level.  A  kilowatt-hour  saved  is  a  kilowatt-hour  earned. 

It  can  be  resold  to  some  other  customer  without  generating  it  anew. 

b.  Displace  with  efficiency  improvements,  passive  solar  measures,  and 
some  cost-effective  active  solar  measures  the  two-fifths  of  electri¬ 
city  now  used  for  low-temperature  heating  and  cooling.  (That  is  why 
some  Northwest  private  utilities  now  offer  zero- interest  insulation 
loans:  the  electricity  saved  is  far  cheaper  than  new  generation.) 

c.  Make  the  lights,  motors,  smelters,  appliances,  etc.  cost-effec¬ 
tively  efficient  compared  to  building  a  new  plant.  (TVA  has  been 
developing  a  proposal  to  treat  such  efficiency  improvements  as  equiv¬ 
alent  to  new  generation,  eligible  for  PURPA  buyback  in  the  form  of  a 
TVA  voucher  applicable  to  the  purchase  price  of  the  equipment.) 

Just  these  first  three  measures  will,  I  believe,  approximately  quadruple 
U.S.  electrical  use  efficiency  [4],  at  a  cost  generally  below  present 


4.  The  main  terms  are  (b ) ,  saving  two-fifths  of  total  electricity,  and 
Tndustrial  motor  retrofits,  saving  over  a  quarter  of  the  rest.  The  most 
detailed  analysis  of  measures  (a)-(d),  done  by  my  colleague  David  Olivier 
for  the  U.K.  Atomic  Energy  Authority,  shows  a  nearly  sevenfold  improve¬ 
ment  in  British  electrical  efficiency  at  well  below  the  cost  of  (e) . 
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roLled-in  prices.  The  resulting  demand  eouid  be  met  with  no  thermal 
plants,  old  or  new,  but  only  present  hydro,  small-scale  hydro,  and  a 
modest  amount  of  windpower.  But  if  still  more  electricity  were  desired, 
the  next  higher  points  up  the  electricity  supply  curve  would  include: 

d.  Industrial  cogeneration,  comb ined-heat-and-power  stations,  low- 
temperature  heat  engines  operated  by  industrial  waste  heat  or  solar 
ponds,  filling  empty  turbine  bays  in  existing  large  dams,  modern  wind 
machines  or  microhydro  in  good  sites,  or  possibly  new  developments  in 
photovoltaics  (especially  using  cheap  optical  concentrators  and  waste- 
heat  recovery  for  an  economic  credit  [5]). 

It  is  only  after  all  these  options  had  been  exhausted  that  one  would  even 
consider 

e.  Building  a  new  central  power  station — 

because  that  is  the  costliest  and  slowest  known  way  to  get  more  electri¬ 
city  (or  to  save  oil). [6] 

Given  this  array  of  options,  what  follows  from  PURPA's  creation  of  a 
competitive  market  in  generation?  There  is  currently  a  strong  economic 
incentive  to  install  your  own  generating  capacity — in  your  factory,  in 
your  backyard,  or  (as  cheap  solar  cells  arrive  in  the  next  few  years)  on 
your  roof.  Whatever  power  you  sell,  the  utility  must  pay  you  "avoided 
cost"  for  it.  But  your  power  is  not  only  cheaper  than  the  utility's 
marginal  cost;  it  may  well  undercut  the  rolled- in  price  too.  Your  compe¬ 
tition  reduces  the  utility's  revenues  while  increasing  its  overcapacity 
and  hence  its  burden  of  fixed  charges  per  kilowatt-hour  sold.  The  util¬ 
ity  must  therefore  raise  its  price.  But  that  increases  your  incentive  to 
generate  and  resell  more.  Where  this  positive  feedback  loop  ends,  I  sus¬ 
pect,  is  in  the  economic  and  technical  obsolescence,  over  the  next  ten  to 
twenty  years,  of  $100-200  billion  net  worth  of  thermal  generating  plants. 
Repealing  PURPA  would  not  prevent,  but  only  slightly  postpone,  this 
outcome — the  inevitable  fate  of  a  capital  stock  that  is  fundamentally 
uncompetitive  even  in  marginal  operating  costs  with  existing  alternatives 
widely  available  to  end-users. 

Is  this  really  true,  not  only  of  the  admittedly  expensive  new  plants — 
option  (e)  above — but  also  of  existing  thermal  plants  whose  capital  cost 
is  already  sunk?  The  only  marginal  internal  cost  of  operating  them  is 
their  cost  of  fuel,  plus  operation  and  maintenance  for  the  plant  rnd 
perhaps  for  its  associated  marginal  grid.  For  a  nuclear  plant,  depending 
on  age,  that  cost  (neglecting  the  present  value  of  waste  management  and 
decommissioning)  can  be  as  low  as  about  1-24/kW-h.  But  even  that  is  more 
than  the  cost  of  efficiency  improvements  —  like  the  0.4i/kW-h  weatheriza- 
tion  and  the  0 .6-0 ,8i/kW-h  industrial  motor  retrofits — which  are  collec¬ 
tively  sufficient  to  displace  all  existing  nuclear,  oil,  and  gas  capa¬ 
city.  Thus  if  one  had  just  built  a  new  nuclear  power  plant,  one  would 
save  the  country  money  by  writing  it  off  and  never  operating  it!  Under 
U.S.  tax  laws,  the  additional  saving  from  not  having  to  pay  its  stream  of 

5_.  DOE  now  expects  central-station  photovoltaics — far  from  the  most 
cost-effective  application — to  compete  on  U.S.  grids  in  1986.  Many 
dispersed  uses,  especially  with  cogeneration,  are  worthwhTTe  already  or 
will  be  within  a  year  or  two.  This  assumes  only  existing  technology;  but 
second-generation  cells  which  promise  to  be  far  cheaper  are  likely  to  be 
here  in  the  next  few  years  before  we  know  what  to  do  with  them. 

_6.  My  1  January  1981  memo  to  David  Stockman  describes  how  two  measures 
with  payback  times  of  a  few  years  can  eliminate  U.S.  oil  imports  by  about 
1990.  See  also  Energy/War:  Breaking  the  Nuclear  Link  (Friends  of  the 
Earth,  124  Spear  St.,  San  Francisco  CA  94 1 05 2  ,  l98(),  pp.  91-98. 
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future  subsidies  and  profits  would  probably  suffice  to  recoup  its  sunk 
capital  costs  too  [7]. 

With  competition  in  their  territories  raising  their  own  overcapacity, 
many  utilities  plan  to  sell  their  surplus  output  to  someone  else — tradi¬ 
tionally  the  utility  next  door.  Today  the  assumed  long-term  market  is  in 
particular  regions,  assumed  to  represent  "black  holes" — infinite  inelas¬ 
tic  markets  for  electricity,  such  as  New  England,  New  York,  Florida,  Mis¬ 
sissippi,  Arizona,  and  California.  (TVA  even  has  ambitions  to  wheel 
power  to  Arizona!)  Unfortunately,  a  great  many  utilities  are  hoping  to 
sell  gigantic  surpluses  to  these  same  black  holes  simultaneously.  It 
won't  work.  More  utilities — including  many  in  Canada — will  be  seeking  to 
sell  more  electricity  to  an  ever  smaller  U.S.  market.  There  is  no  geo¬ 
graphic  escape  from  the  uncompetitiveness  of  the  utilities'  product. 

Nor  is  there  an  escape  through  higher  prices,  in  whatever  guise.  Roger 
Sant  was  recently  discussing  his  findings  with  some  some  utility  execu¬ 
tives.  They  nonetheless  continued  to  call  for  rate  relief — until  John 
Bryson,  President  of  the  California  PUC,  said,  "Roger's  just  been  telling 
you  that  at  the  1978  prices,  43%  of  your  product  was  uncompetitive.  Now 
you  want  higher  prices  so  that  maybe  60%  or  80%  will  be  uncompetitive?" 
Higher  prices,  like  higher  subsidies,  are  worse  than  a  merely  cosmetic 
approach  to  the  utilities'  disease;  they  actually  reinforce  it. 

Powerful  market  forces  are  converging  on  the  utilities:  high  interest 
rates,  falling  ratios  (current,  coverage,  and  market/book) ,  increasing 
dependence  on  "funny  money"  (AFUDC)  and  other  creative  bookkeeping,  stag¬ 
nant  demand,  real  cost  escalation,  greater  consumer  opposition  to  rate 
hikes,  heavy  short-term  borrowing  to  pay  dividends,  shareholder  efforts 
to  prevent  further  dilution  of  equity  (thus  forcing  even  higher  debt/ 
equity  ratios),  and  many  more.  These  signals  are  not  fortuitous  arti¬ 
facts.  They  offer  unmistakable  evidence  that  the  utilities'  financial 
problems  are  of  a  fundamental  nature — both  fiscal  and  economic.  A  util¬ 
ity  can  go  broke  without  suffering  a  catastrophic  GPU-style  loss-of-cash- 
flow  accident,  simply  because  its  business  takes  too  much  cash,  pays  it 
back  too  slowly,  is  unexpectedly  price-elastic,  and  cannot  compete. 

Even  the  most  gifted  managers  would  be  hard  pressed  to  sustain  such  an 
unpromising  venture;  but  the  utility  sector  is  oversupplied  with  mediocre 
managers,  often  with  grievously  little  prospect  of  attracting  better. 

The  hottest  management  seat  in  industry  today  is  finding  few  inspired 
takers.  However  this  long-standing  problem  of  management  quality  is  to  be 
resolved,  the  market  is  clearly  signalling  that  utilities  are  no  longer  a 
sound  investment.  How,  then  can  the  utility  sector  be  smoothly  recycled 
into  a  form  whose  product  the  market  is  willing  to  buy,  and  how  can  we 
meanwhile  avoid  serious  dislocations  in  our  financial  system? 


What  is  to  be  done? 

I  have  summarized  elsewhere  (2,8]  a  possible  framework  for  remedy  which 
appears  to  merit  prompt  attention  and  refinement.  It  includes: 

1.  Utilities  should  be  considered  in  the  business  of  supplying,  not 
kilowatt-hours  per  se,  but  rather  energy  services  or  the  financial 
means  of  providing  them  (a  position  already  adopted  by  some  well-man- 
aged  private  utilities  and  by  the  American  Public  Power  Association). 

TT  For  detai  Is ,  see  Energy/War,  op.  cit,  [6] ,  pp.  48-49. 

California  PUC  (San  Francisco),  Energy  Efficiency  and  the  Utilities: 
New  Direct  ions ,  I960,  pp  168-78  (concluding  keynote);  see  also  /z, 

1 3^—42 ,  lil-2,  165,  and  many  other  statements  by  industry  leaders. 


2.  State  utility  Comm i s s i on s  should,  like  California's  and  Idaho's, 
permit  new  construction  (or,  generally,  continuation  of  existing  major 
construction)  only  if  that  marginal  investment  is  shown  to  be  the 
cheapest  way  to  provide  the  incremental  energy  services  for  which  the 
incremental  electricity  would  be  used.  Otherwise,  utilities  should 
loan  out  their  money  on  mutually  advantageous  terms  so  consumers  of 
all  classes  can  do  the  cheaper  things  first.  (To  keep  this  "invest¬ 
ment  balancing  test"  honest,  a  utility  which  passes  it  and  builds  the 
plant  should  not  be  allowed  to  rate-base  more  than  the  real  plant  cost 
it  assumed  when  comparing  the  proposed  plant  with  other  options.) 

3.  The  loans  should  be  made  at  the  utility's  post-subsidy  cost  of 
money  (in  practice,  near  embedded  cost,  for  reasons  explained  below). 
Borrowers  would  then  pay  back  the  loans  through  their  bills  only  as 
fast  as  the  energy  saving  saves  them  money — the  TVA  "graduated-payback" 
system.  Borrowers  would  thus  need  no  capital,  and  all  options  would 
enjoy  equal  access  to  capital,  encouraging  fair  competition. 

4.  The  loans — which  I  call  "capital  transfers" — should  be  made  from  a 
revolving  fund  "below  the  line",  i.e.  neither  rate-based  nor  expensed, 
though  transaction  costs  could  be  expensed.  (Two-fifths  of  U.S.  gen¬ 
erating  capacity  belongs  to  utilities  already  giving  or  about  to  give 
analogous  loans:  generally  with  rate-basing,  fast  payback,  and  subsi¬ 
dized  interest — a  less  efficient  scheme  than  that  proposed  here.) 

5.  Rate  reform  should  as  nearly  as  possible  ensure  that  incremental 
consumption  attracts  true  incremental  cost. 

6.  Cooperating  utilities'  deferred  taxes  under  accelerated  deprecia¬ 
tion — an  overhang  nationally  totalling  some  $13  billion  (mixed  current 
$)  which  falls  due  when  a  utility  stops  growing — should  probably  be 
forgiven.  The  Treasury  was  not  going  to  get  most  of  it  anyway,  since 
it  was  being  shoved  off  into  the  never-never  and  paid  in  vastly  infla¬ 
ted  dollars.  The  forgiveness  should  preferably  be  part  of  a  broader 
Bat inovi ch-style  plan  [2^9]  to  desubsidize  the  utilities  systematical¬ 
ly  by  abolishing  their  federal  income  taxes.  (Most  of  them  currently 
pay  negative  taxes,  at  least  on  marginal  investments.  The  tax  timing 
inefficiently  encourages  premature  construction  and  premature  retir¬ 
ement;  the  subsidies  are  unnecessary  and  inefficient  for  a  regulated 
monopoly  required  to  meet  demand  anyhow;  and  any  revenue  gain  would  be 
more  simply  obtained  by  a  direct  electricity  excise.) 

This  package  of  measures  would  have  the  following  consequences: 

a.  Consumers,  regardless  of  class  or  income,  can  make  any  fuel-saving 
investments  which  are  cheaper  than  marginal  utility  investments,  but 
without  needing  the  capital  up  front. 

b.  Utilities  can  participate — at  arm's  length — in  the  highest-return 
investments  in  the  entire  economy.  (They  would  not  own,  lease,  in¬ 
stall,  control,  or  specify  the  investments;  measures  are  available  to 
protect  consumers  from  supplier  fraud  without  projecting  utilities 
into  a  business  they  are  not  good  at  or  risking  an  appearance  or  fact 
of  anti-competitive  activity.)  The  new  marginal  investments  would 
yield  about  ten  times  as  much  energy  per  dollar  as  those  they  replace. 

c.  Instead  of  tying  up  dollars  in  a  power  plant  that  pays  back  in 
30-40  years  (if  ever),  utilities  can  turn  dollars  over  every  few  years 
about  ten  times  as  fast.  This  greatly  increased  velocity  of  cash-flow 

9.  C.  Davis  provides  an  excellent  analysis  of  utility  subsidies  and  whv 

To  remove  them:  4  Harv.  Envir.  L.  Rev .  311-358  (1980). 
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will  enable  many  utilities  to  finance  a  larger  energy  program  than 
they  had  before,  but  without  needing  to  go  to  the  market  for  new  debt 
or  equity  capital:  they  can  merely  bootstrap  their  retained  earnings 
(totalling  some  $11  billion  a  year,  of  which  perhaps  half  is  real 
money)  because  the  revolving  fund  revolves  so  quickly.  Because  the 
capital  is  largely  or  wholly  internal — embedded  capital  already  earn¬ 
ing  a  return — the  utility  can  loan  at  close  to  its  embedded  cost  of 
money.  It  then  takes  the  cash-flow  benefit  of  avoiding  the  high  mar¬ 
ginal  cost  of  new  money  from  outside.  (There  are  also  obviously  some 
national  macroeconomic  benefits  for  interest  rates,  employment,  etc.) 

d.  Utilities  can  have,  at  the  margin,  a  short-lead-t ime ,  fast-payback 
business.  Its  short  time  constants  remove  the  instability  in  their 
cash-flow.  They  are  no  longer  at  risk  of  going  broke  by  building  more 
plants  than  they  can  pay  for.  New  construction,  having  failed  the 
investment-balancing  test,  is  no  longer  hemorrhaging  cash. 

e.  All  marginal  investment  opportunities  to  provide  energy  services 
are  now  being  symmetrically  compared,  not  with  old  cheap  natural  gas, 
but  with  the  marg inal  cost  represented  by  the  proposed  new  plant.  Most 
of  the  capital  going  into  the  U.S.  energy  system  is  therefore  being 
allocated  as  i f  energy  were  priced  at  the  margin,  whether  it  is  or 
not.  We  have  thus  largely  done  an  end-run  around  the  awkward  problem 
of  finding  energy  prices  that  are  both  equitable  and  efficient. 

f.  For  the  next  fifty  years  or  so,  as  tney  turn  into  a  distribution 
service  like  the  telephone  company,  utilities  have  something  useful  to 
do  which  they  can  do  well  and  feel  good  about.  They  are  using  their 
financial  talents  and  existing  billing  relationships  to  minimize 
transaction  costs.  Their  goal  is  a  socially  efficient  allocation  of 
capital  to  meet  consumers'  energy  service  needs  at  least  cost. 

g.  l/nlike  plans  which  rate-base  conservation  loans,  this  scheme 
leaves  the  incentive  to  invest  efficiently  in  the  hands  of  the  party 
(the  householder,  factory-owner,  etc.)  who  is  making  the  investment. 
Further,  treating  the  loan  below  the  line  protects  the  utility  if 
price  elasticity  of  revenue  turns  out  to  be  negative.  The  utility's 
passed-through  cost  of  money  is  a  wash;  the  utility’s  return  is 
unchanged;  and  the  utility's  cash-flow  benefits  are  enormous. 

h.  Unlike  plans  which  offer  low-  or  zero- interest  loans,  this  scheme 
permits  and  indeed  requires  investment  in  alternatives  up  to  the  mar¬ 
ginal  cost  of  conventional  supply.  No  complex  "no-losers"  test  is 
required,  since  nonparticipants  benefit  instead  of  being  penalized. 

i.  Though  this  scheme  could  be  facilitated  by  federal  action,  espe¬ 
cially  in  tax  reform,  it  can  probably  be  done  entirely  at  a  state 
level,  often  without  new  legislation.  Only  existing  institutions, 
modestly  adapted,  would  be  needed. 

The  foregoing  proposals  address  both  the  fiscal  problems  of  the  utilities 
— by  stabilizing  cash-flow  and  prices — and  their  economic  problems — by 
redirecting  their  marginal  investments  into  competitive  channels.  There 
will  undoubtedly  turn  out  to  be  special  cases  requiring  special  treat¬ 
ment.  (For  example,  some  utilities  have  no  retained  earnings  with  wnich 
to  capitalize  a  revolving  fund.  Possible  alternative  sources  of  initial 
capitalization  include  public  bond  issues  and  a  couple  of  years’  tempoi — 
arily  excess  tailblock  revenues  in  the  course  of  flattening  or  inverting 
an  existing  decl ining-block  rate  structure.)  But  the  general  principles 
presented  here  appear  to  be  consistent  wi'h  sound  market  theory  logically 
applied  to  utilities'  pressing  financial  proolems.  That  is  why  man, 
utilities  are  expressing  great  interest  in  exploring  and  refining  them. 
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I  therefore  hope  you  will  be  duly  skeptical  about  doctrinaire  assumptions 
that  power-plant  construction  is  vital  to  the  national  welfare;  that 
utility  rate  relief  is  essential  to  their  financial  integrity;  and  that 
lame-duck  utilities  are  so  important  to  preserve  in  unaltered  form  that 
they  must  be  resuscitated  by  heroic  measures,  notably  subsidies  of  the 
kind  urged  in  the  transition-team  Halbouty  Report  from  the  President's 
Energy  Advisory  Task  Force.  There  is  compelling  evidence,  on  the  con¬ 
trary  [10],  that  power-plant  construction  is  an  egregious  misuse  of 
scarce  national  resources  and  will  retard  oil  displacement  by  diverting 
investment  from  measures  that  would  save  more  oil  faster  and  cheaper  [6]; 
that  Commissions  reluctant  to  grant  rate  relief  uncritically  are  doing 
their  best  to  save  utilities  from  their  own  folly;  and  that  more  sub¬ 
sidies  are  the  surest  way  to  ensure  the  bankruptcy  of  the  utility  sector 
on  a  scale  beyond  the  ability  even  of  the  Treasury  to  bail  it  out. 

Should  you  wish  to  pursue  these  concepts  further,  I  should  be  glad  to 
meet  with  you  or  your  advisors  on  one  of  my  forthcoming  visits  to 
Washington.  Meanwhile,  let  me  suggest  that  there  is  a  case  for  setting 
up  without  delay  a  small,  high-powered  task  force  of  analysts  who  have 
already  devoted  a  great  deal  of  thought  to  these  problems.  I  should  be 
glad  to  help  you  identify  key  people,  mainly  in  the  financial  community, 
whose  insights  could  be  of  lasting  national  service.  If  your  Department 
waits  until  a  Chrysler-1 ike  situation  has  actually  developed,  flexibility 
of  action  will  already  be  severely  constrained  and  a  large  measure  of  the 
public  confidence  which  one  had  sought  to  preserve  will  already  stand  in 
jeopardy.  It  is  vital  to  use  this  short  breathing-space  to  develop  in 
advance  some  prudent  contingency  plans.  Only  thus  can  you  have  at  hand, 
when  a  politically  visible  crisis  does  loom,  the  background  analyses  you 
will  need  to  forestall  hasty  and  ill-considered  proposals  that  do  not 
grasp  the  full  depth  of  the  utilities'  plight. 


10.  Among  the  most  cogent  demonstrations  that  utilities'  financial  risk 
can  be  greatly  reduced  and  their  cash-flow  markedly  improved  by  abandon¬ 
ing  partly  built  power  stations  in  favor  of  efficiency/renewables  invest¬ 
ments  is  E.  Kahn  et  al . 1 s  "Commercialisation  of  Solar  Energy  by  Regulated 
Utilities:  Economic  and  Financial  Risk  Analysis,"  LBL-1139S,  October 
1980,  Lawrence  Berkeley  Laboratory  (Berkeley  CA  94720):  see  especially 
Figs.  6  and  8. 


APPENDIX  B:  NUCLEAR  WEAPONS  AND  POWER-REACTOR  PLUTONIUM 
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The  following  review  article  appeared  in  Nature  283:817- 
823,  28  February  1980. 

Nuclear  weapons  and 
power-reactor  plutonium 

Amory  B.  Lovins 

Consultant  Physicist,  c/o  Friends  of  the  Earth  Ltd.  9  Poland  Street,  London  W1 V  3DG.  UK 


With  modest  design  sophistication,  high-burn-up  plutonium  from  power  reactors  can  produce  powerful 
and  predictable  nuclear  explosions.  There  is  no  way  to  4 denature '  plutonium.  Power  reactors  are  not 
implausible  but  rather  attractive  as  military  production  reactors.  Current  promotion  of  quasi-civilian 
nuclear  facilities  rests,  dangerously,  on  contrary  assumptions. 


Nuclear  policy,  especially  in  Europe,  has  often  been  justified 
by  the  belief'"'"  that  for  making  nuclear  bombs,  ’reactor-grade' 
plutonium  produced  by  the  normal  operation  of  uranium - 
fuelled  power  reactors  is  necessarily  much  inferior  to  specialty 
made  'weapons-grade'  Pu:  so  inferior  in  explosive  power  or 
predictability  that  its  potential  use  by  amateurs  is  not  a  serious 
problem  and  that  governments  would  instead  make  the  higher- 
performance  weapons-grade  Pu  in  special  production  reactors. 

Although  that  belief  is  false  it  was  vigorously  asserted  during 
1978-79  by  responsible  Ministers  or  by  Prime  Ministers  in  at 
least  three  high-technology  nations.  This  was  apparently 
because  some  of  their  nuclear  experts  did  not  know  differently, 
and  rejected  contrary  official  US  statements  as  being  exag¬ 
gerated  or  even  politically  motivated;  or  because  those  experts 
who  did  know  were  not  asked;  or  because  correct  technical 
advice  was  lost,  oversimplified,  or  garbled  in  transmission 
through  advisors  who  did  not  understand  the  physics.  Here  I 
attempt  to  clarify  the  properties  and  performance  of  various 
grades  of  Pu,  outlining  the  physical  logic  explicitly  enough  to 
ensure  understanding  although  discreetly  so  as  not  to  help  the 
malicious:  certain  details  and  technical  references  have,  there¬ 
fore,  been  omitted  and  some  calculations  treated  in  conclusory 
fashion. 

The  possible  military  utility  of  power-reactor  Pu  has  caused 
widespread  professional  confusion  since  1946.  Although  some 
leading  scientists  appreciated  even  then'  "  that  it  was  useable  in 
bombs  or  might  become  so,  the  contrary  assumption  (admittedly 
hedged)  was  made  in  the  Acheson-Lilienthal  report'2  ”.  This 
recommended  that  certain  nuclear  activities  could  be  classified 
as  safe'  because  the  Pu  they  produced  could  not  be  converted 
without  timely  warning  into  weapons-useable  form,  and  that 
these  activities  could  thus  be  carried  out  by  nations  if  under  strict 
and  enforceable  international  controls.  With  the  radical  1953 
Atoms  for  Peace  initiative,  the  report's  finding  that  international 
inspections  and  treaties  could  not  stop  proliferation  was  forgot¬ 
ten,  and  US  nuclear  knowledge  and  materials  were  distributed 
worldwide  with  increasing  enthusiasm  and  decreasing  cure14— 
apparently  on  the  assumption  that  power-reactor  Pu  was,  or 
could  be  made,  unsuitable  for  use  in  bombs  ('denatured'), 
despite  the  US  Atomic  Energy  Commission's  refutation  of  this 
notion”  in  1952.  With  this  in  many  signatories'  minds,  the 
Non-Proliferation  Treaty  (NPT)  was  negotiated  in  1967;  an 
important  fact  to  recall  when  construing  the  NPT  today,  even 
though  its  text  and  the  International  Atomic  Energy  Agency 
(IAEA)  do  not  distinguish  in  quality  between  Pu  made  in  power 
or  in  military  production  reactors 

Beginning  publicly  in  the  early  1970s  in  the  US  (earlier  in  the 
Soviet  Union  and  France”),  the  assumption  that  power-reactor 
Pu  wav  unsuitable  for  bombs  was  questioned  with  increasing 
force ’’  '"  Bv  |9"4.  authoritative  reports'"  "  had  concluded  that 


reactor-grade  Pu  could  be  used  even  by  amateurs  to  make 
effective  fission  bombs,  albeit  of  somewhat  reduced  and 
uncertain  yield2'  25.  Further  analyses  during  1976-77,  mainly  at 
the  US  weapons  laboratories,  revealed  a  still  wider  spectrum  of 
technical  possibilities,  and  in  1977  the  US  announced  that  it 
had  successfully  tested  a  bomb  made  from  reactor-grade  Pu2* 2’. 
Yet  the  earlier  finding  that  this  material,  though  useable,  was 
inferior  if  used  in  relatively  crude  bomb  designs  was  widely  and 
wrongly  supposed  to  apply  to  all  designs.  In  particular,  reactor- 
grade  Pu  was  alleged  to  be  inherently: 

— far  more  hazardous  than  weapons-grade  Pu  to  people 
dealing  with  it;  or 

— far  more  likely  to  cause  unintentional  explosions;  or 
— incapable  of  exploding  violently  enough  to  do  much 
damage,  or,  at  worst,  to  accomplish  most  military  aims, 
or 

^too  unpredictable  in  explosive  yield  to  be  acceptable  to 
its  users. 

Each  of  these  assumptions  contains,  in  certain  circumstances, 
some  truth;  but  each  is  generally,  or  can  by  plausible  counter¬ 
measures  be  rendered,  false.  Their  implication  that  reactor- 
grade  Pu  is  not  very  dangerous,  or  unlikely  to  be  attractive  to 
governments,  is  wishful  thinking,  and  causes  the  proliferation 
risks  of  ‘civil’  nuclear  activities  to  be  gravely  underestimated. 

In  recent  years,  advocates  of  commercial  Pu  use.  in  referring 
to  the  bomb-making  that  might  also  result,  have  had  to  retreat 
"from  the  original  concept  of  denaturing  to  the  notion  of  making 
do  with  less  than  optimal  material”";  yet  the  earlier  myth 
lingeringly  distorts  policy’*.  To  decide  responsibly  about 
nuclear  power  and  nuclear  fuel  reprocessing,  we  must  know 
exactly  what  "less  than  optimal”  means,  and  hence  must  cau¬ 
tiously  review  published  physical  principles  The  only  thing 
more  dangerous  than  discussing  this  subject  is  not  discussing  it; 
the  lesson  of  Atoms  for  Peace  may  yet  be  that  with  Pu,  wc  must 
get  our  assessments  right  the  first  time 

Plutonium  production 

AM  nuclear  reactors  fuelled  with  uranium  "  ( notably  the  0.7%- 
naturally-abundant  species  2”U)  produce  ”"Pu  by  neutron 
absorption  in  fertile  2,"U.  Some  of  the  2”Pu  formed  is  fissioned, 
an  increasing  fraction  absorbs  successively  more  neutrons  to 
form  higher  Pu  isotopes,  chiefly  24,4"  2  42Pu,  and  transplutonic 
elements'";  and  some  of  the  resulting  :w  :4'Pu  tplus  traces  of 
:'"Pu  and  related  species)  survives  until  the  fuel  is  discharged 
Depending1’ 24 ''  on  the  type  and  detailed  design  of  reactor,  the 
composition  of  initial  fuel,  and  the  manner  of  operation,  espe¬ 
cially  the  burn  up  (extent  of  exposure  of  the  fuel  to  neutrons), 
the  net  Pu  production  of  a  1-CiWe  power  reactor  is  typically 
several  hundred  kgyr  '.  for  example  -  210  240  kg  yr  '  for  a 
light  water  rcavtoi  <1  \\  Ri.  the  dominant  commercial  type 
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Fig.  1  Typical  loial  amount  and  isotopic  composition  of 
plutonium  in  discharged  fuel  as  a  function  of  burn-up  in  a  light- 
water  reactor32.  The  exact  values  depend  in  detail  on  reactor 
design  and  operation  and  on  initial  fuel  composition.  Higher 
isotopes  of  plutonium  and  transplutonics  become  more  abundant 
in  repeatedly  recycled  fuel. 

For  a  given  reactor,  the  isotopic  composition  of  the  discharged 
Pti  depends  predictably  on  bum-up.  If  each  metric  ton  of 
uranium  (TU)  yields  only  a  few  gigawatt-days'  thermal  energy 
(GWt-d),  neutron  capture  is  so  limited  that  nearly  pure  714  Pu— 
'weapons-grade'  Pu — is  produced  It  contains  no  more'  than 
7%34  or  8%"  24"Pu.  typically31  around  6%;  perhaps  0.5% 
34lPu;  negligible  242Pu  and  23“Pu. 

Higher  burn-up.  whether  through  leaving  the  fuel  in  the 
reactor  longer  or  exposing  it  to  a  more  intense  neutron  flux, 
produces  a  larger  proportion  of  the  higher  Pu  isotopes  (Fig.  1 ). 
Low-enriched  uranium  fuel  (the  usual  kind)  left  for  the  full 
3-4  yr  in  a  reliably  operating  LWR  is  usually  designed  for  a 
nominal  bum-up  of  27-33  GWt-tLT.  The  latter  corresponds31 
to  discharge  Pu  containing  -58%  23v  Pu  and  11%  2*'Pu  (both 
fissile)  plus  25%  34"Pu,  4%  ;4;Pu,  and  2%  23,Pu.  This  composi¬ 
tion  is  broadly  similar  for  other  thermal  or  fast  reactor  types, 
except  for  graphite-moderated  reactors34  (!4n*!4!Pu  —  20%)  and 
fast  breeder  radial  blankets3"  (-4%).  In  some  circumstances  the 
r«.24rpu  fraction  can  rjse  from  a  nominal  -29%  to  as  much 
as  49%  (34%  24"Pu,  15%  242Pu)33  in  equilibrium  LWR  Pu  re¬ 
cycle  fuel;  this  is  unusually  high  and  approximates  a  practical 
limit. 


Power  reactors  also  can,  and  often  do,  discharge  fuel  short  of 
its  full  design  burn-up.  Mature  US  LWR  cores  routinely  attain 
well  below  design  burn-up”.  Real  or  simulated  malfunctions, 
such  as  leaky  fuel  cladding,  may  lead  the  operator  to  discharge 
fuel  at  very  low  burn-up'.  Alternatively,  manipulation  of  fuel 
rods  can  produce  a  core  with  high  average  burn-up  but  contain¬ 
ing  some  rods  of  much  lower  burn-up  'On-load-refuelling' 
reactors  such  as  Magnox  and  CANDU  are  suitable  for  clan¬ 
destine  introduction,  brief  exposure,  and  removal  of  small  but 
adequate  amounts  of  fertile  material  in  a  few  fuel  channels.  Such 
methods  are  not  necessarily  easy  to  detect  even  if  an  inspector 
were  continuously  present,  and  would  probably  not  be  detected 
at  all  by  present  international  safeguards3'1. 

Because  burn-up,  and  hence  isotopic  composition  of  dis¬ 
charge  Pu,  can  vary  enormously  between  and  within  reactors 
and  with  time,  'reactor-grade  Pu'  is  not  a  well-defined  term. 
Weapons-grade  Pu,  which  is  fairly  well-defined  (supra),  can  be 
readily  produced  in  any  power  reactor  without  necessarily  and 
significantly  decreasing  efficiency,  increasing  costs,  or  being 
detected.  But  though  that  option  is  always  open,  we  assume  here 
that  it  is  not — that  power  reactors  will  be  used  to  produce  only 
high-burn-up  Pu.  We  also  assume  that  'reactor-grade  Pu' 
implies  a  !‘u*24Jpu  content  of  -30%;  higher,  even  arbitrarily 
higher,  even-isotope  content  will  not  affect  the  argument,  while 
a  lower  content  would  strengthen  it.  On  these  conservative 
assumptions,  the  Pu  discharged  from  power  reactors  will  be 
shown  to  have  major  military  potential. 

Plutonium  properties 

Relevant  nuclear  properties  of  the  common  Pu  isotopes  are 
summarised  in  Table  1.  The  values  given  for  m,.  are  not  the 
quantities  needed  to  make  a  bomb,  as  neutron  reflection  and 
implosion  can  reduce  critical  mass  by  a  large  factor.  This  factor 
has  been  officially  stated  to  be  -  5,  consistent  with  the  US30  and 
IAEA  requirement  of  strict  physical  security  measures  for 
quantities  of  Pus* 2  kg  (independent  of  isotopic  composition). 
Published  data  suggest,  however,  that  with  sophisticated  design 
the  factor  may  be  >5.  For  example,  in  its  densest  (a-phase) 
allotropic  form,  23,Pu  at  normal  density  in  a  thick  Be  reflector 
has  a  reported  critical  mass  as  small  as  mj 4,  and  large  reflector 
savings  are  also  obtainable  with  nonmoderating  (and  partly 
fast-fissionable)  reflectors  such  as  23"U.  Further,  if  the  core  and 
reflector  are  equally  compressible  and  if  the  ratio  of  reflector 
thickness  to  core  radius  remains  constant  during  compression, 
critical  mass  varies  as  the  inverse  square  of  core  density.  Densi¬ 
ties  'several  times'  normal  are  said  to  be  attained  in  military 


Table  I  Some  properties  o(  plutonium3' 34'3’ 311 


Decay  properties 


Isotope 

Half  life 
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:3*Pu 

86.4 

5.5  a 

17.4 

•''"Pu 

24.390 
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-74"Pu 

6,600 
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0.23 

34  'Pu 

13.2 

0.02 1  0 
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34Pu 

387.000 

4.9  a 

0.0038 
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3.43 

Heat 
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Fast  fission 

<r,t 
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Rate 
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V* 

ibarni 

mg'  s'  i 

£SfS 

567 

9 

-3’ 

2.51 

2.600 

2.3 

19 

in 

3  1 

1.9 

0.03 

2  9 

7,1) 

40 

3.4 

1.3 

1.020 

2  2 

4  5 

12 

3.2 

1.8 

— 

— 

0.1 

106 

90' 

114” 

3.3 

1.2 

1.670 

0623 

2.3 

3  1 

‘Approximate  bare-sphere  prompt-critical  mass  at  normal  density;  Pu  is  a -phase  (p  =  19.8  gem"3  For  comparison.  mc  for  93. 5%  333U 
(p  =  18  8  gem"3)  is  49  kg  235U. 

2  Approximate  gross  neutron  yield  per  fast  fission  (Argonne  16-group). 

t  Approximate  fast-fission  cross-section  (Argonne  16-group).  (The  capture-to-fission  ratios  are  also  important,  and  tend  to  be  high  for  even  Pu 
isotopes  ) 

i  Approximate  neutron  yield  per  spontaneous  fission. 

II  Values  cited  by  De  Volpi37,  who  gives  the  !3llPu  m,  as  7  kg  (unpublished),  the  best  value  calculated  for  a  -phase,  however,  is  the  m<  -  9  2  kg  shown 
here  ( R  .  36 .  Selden.  personal  communication). 

*  Best  Livermoreestimate  from  the  range  75-100  kg(R.  W.  Selden,  personal  communication!  De  Volpi37  assumes  -  95  kg  lor  1 18  kg  in  Appendix 
H).  but  used  »  156  kg  in  earlier  publications43  44.  Calculated  m,  is  probably  not  finite  for  :4:Pu'"B-,  owing  to  threshold  etlests.  but  is  -350  kg  for 
’4"Pu  "'B;  at  p  =  II  5  «cm  1  (R  W  Selden,  personal  communication! 

*  Daughter  of 141  Pu.  important  (like  the  trace  isotope  ’’"Pul  mainly  for  its  v  emissions 

■*  Approximate  estimate  by  Clayton '"  for  p  -  1 1  7  g  em  ,  implying  reactivity  comp  arable  with  '  "’Pu 
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bombs4",  and  by  means  described  in  the  open  literature  a  slightly 
subcritical  mass  of  a -phase  '"'Pu  in  a  U  reflector  can  be 
compressed  to  1.85  times  its  initial  density,  corresponding  to  a 
reactivity  increase  of  -3  4  times.  The  same  method  can  yield 
even  higher  compressions.  Although  high  compression  is  in¬ 
consistent  with  simultaneous  high  reflection,  it  may  be  possible 
to  achieve  significant  supercriticality  with  initial  !’"Pu  masses 
under  2  kg.  Regardless  of  the  exact  figure,  the  IAEA's  8-kg 
significant  quantity'  design  basis  for  detecting  diversions1'' 
seems  far  too  high. 

Of  the  Pu  isotopes  in  Table  I,  only  ■’’“Pu  and  34lPu  are  fissile, 
that  is,  fissionable  by  thermal  (slow)  neutrons.  All  Pu  isotopes, 
however,  are  fissionable  by  the  fast  neutrons  in  a  bomb:  indeed, 
at  energies  >  1  MeV  (69%  of  fission  neutrons)  the  fission  cross- 
section  of  34"Pu  is  less  than  that  of  :’"Pu  by  a  margin  of  less  than 
2(1%,  so  the  amount  of  3,"Pu  required  to  form  a  normal-density 
critical  mass  is  remarkably  insensitive  to  34,,'  343Pu  content 
(Table  2).  Published  neutron  transport  calculations  confirm  that 
the  even  isotopes  produce  only  minor  changes  in  reactivity, 
neutron  spectrum,  and  mean  prompt-neutron  lifetime.  So  reac¬ 
tive  is  34"Pu  that  changing  the  -’•‘"•-’4;pu  content  from  6  to  30% 
increases  mt  only  from  -II  to  -13kg'1.  No  known  fast- 
neutron  absorber  can  make  Pu  of  any  practical  composition 
incapable  of  forming  a  prompt-critical  mass"  43:  calculations43 
suggest  that  substituting  the  best  fast-neutron  absorber  known, 
'"B.  for  oxygen  in  reactor-grade  crystal-density  PuO:  (mc~ 
35  kg)  would  increase  m,  only  to  —  70  kg. 

Fast- fission  properties  of  Pu.  then,  are  only  slightly  affected  by 
ordinary  changes  in  isotopic  composition.  The  neutron  back¬ 
ground  is.  however,  modestly  affected.  Spontaneous-fission 
neutrons  (Table  1)  provide  typically’4  of  the  order  of 
100  n  g  1  s  'in  weapons-grade  Pu.  about  500  in  reactor-grade 
Pu  A  further  contribution  (at  lower  neutron  energies)  comes 
from  in.  n)  reactions  with  light-element  impurities  In  Pu  metal 
this  is  not  an  important  neutron  source14,  but  it  can  more  than 
double  the  neutron  background  in  PuO;,  as  l  Ci  of  o-emitter 
bombarding  oxygen  produces  of  the  order  of  5,000  ns1. 

Neutron  background  from  all  sources  is  significant  for 
weapons  physics  I  infra  I  and  makes  reactor-grade  Pu  give 
somewhat  higher  radiation  doses  than  weapons-grade  Pu.  For 
long-term  commercial  handling  within  the  normal  canons  of 
health  physics,  shielding  would  be  required.  For  clandestine 
weapons  manufacture  it  would  not,  because  the  published  total 
dose  rates  (mainly  y  and  X  rays)  are  relatively  modest — of  the 
order  of  rem  h1  at  the  surface  of  a  1  -kg  fresh  recycled  PuO. 
sphere,  <  1  mrem  h  '  at  1  m.  Even  under  extreme  assumptions 
(18;%  3'"Pu.30%  34"-'43Pu.  10-kg  PuO;  sphere  with  subcritical 
multiplication  included),  neutron  dose  rates  (60  mrem  h  1  at 
1  ml  "do  not  provide  an  effective  deterrent"44.  It  is  obviously 
not  correct  that  "slight  mistakes  in  the  knowledge  of  exact 
[isotopic]  composition  .  .  .  mav  well  pose  extreme  radiological 
hazards"4 ’.  given  normal  precautions  against  inadvertent  criti¬ 
cality 

The  specific  activity  of  reactor-grade  Pu  is  typically4 
-  Ill  Ci  g  1  as  against  3  Ci  g  1  for  weapons  grade  Pu.  the  neu 
iron  background  i  for  metal  >  and  the  inhalation  toxicity  -  5  times 
higher,  anti  the  hc.tt  production  10  W  kg  1  (about  the  same  as 
for  1-yr-old  spent  l.WR  fuel'  as  against  3  W  kg  '.  Only  a 
difference  of  orders  of  magnitude  in  these  quantities  the  extent 
by  which  they  all  exceed  the  corresponding  values  for  3"U  — 
would  reflect  differences  in  ease  of  handling  that  would  be 
important  in  designing  new  bomb-making  facilities43. 

'Thermal  denaturing  44  "■  of  reactor-grade  Pu  was  recently 
proposed  by  A.  K  Williams  cl  a!  (unpublished  Allied-General 
Nuclear  Services)  and  A  De  Volpi'  The  '“Pu  content  would 
be  increased  from  its  normal  I  2%  (nearly  5%  in  some  recycle 
Pu")  to  10-15%,  perhaps  nearlv  20".>,  chietlv  bv  recvvfing 
"  '  Np  i  itself  a  bomb  material  with  >n,  ~  75  -  105  kgi  with  '  Th 
rather  than  "I '  diluent  '  The  “Pn  would  increase  hear 
production  to  6  0  times  normal  Some  calculations14  based  on 
cores  of  high  mass  and  high  volume  to  surf  ice  ratio,  in  lined 
cont.iv t  With  non  therm. ilk  stable  explosives,  slice-.'!  serious 


Table  2  Critical  mass  of  plutonium  spheres  in  a  -10  cm  natural 
uranium  reflector  as  a  function  of  plutonium  isotopic  composition41" 


34,'-343pu 

*  >u  m 
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(atom  °u » 

dgi 

1  kg  1 
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5  6 
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4  b 

b  .7 

40 

4.7 

7.8 

5U 

4  s 

9  6 

*  Assuming  '4"Pu/‘4"Pu  ratio  similar  to  that  shown  in  Fig  1 

design  problems  But  realistic  choices  of  geometry  and  materials 
can  readily  overcome  these  problems  Cooling  does  not  even 
become  an  interesting  design  problem  until  the  :'”Pu  content 
approaches  that  of  a  thermoelectric  heat  source,  and  a  much 
lower  content,  well  over  20%,  does  not  provide  an  effective 
deterrent  even  to  most  amateurs,  though  it  would  make  safe  and 
economic  fuel-cycle  operations  hard  to  envisage4’.  Only  in  quite 
incompetent  hands  could  the  extra  heat  pose  a  danger  of 
unplanned  detonation. 

A  second  denaturing'  proposal  by  De  Volpi"  would  combine 
''“Pu  and  -4"Pu  With  extra  343Pu,  which  is  a  diluent  in  fast  spectra 
and  something  of  a  neutron  poison  in  thermal  spectra4". 
Pathologically  high  343  Pu  content  would  increase  m..  though  not 
by  the  -  30  times  claimed  by  Olds4'  (compare  Table  1 1;  as  all  Pu 
isotopes  have  "  reasonably  small  critical  masses,  this  concept  [of 
denaturing  by  dilution]  is  not  applicable  to  plutonium"44.  De 
Volpi  states4"  that  fuels  made  mostly  of  343Pu  and  with  a  fissile 
fraction  as  low  as  18%  are  useable  even  in  present  fast  reactors, 
but  he  does  not  analyse  performance  or  economics,  which 
apparently  otter  serious  difficulties4',  and  his  analysis  of 
weapons  physics  seems  deeply  flawed 

Synergisms  are  negligible,  so  the  effect  of  each  even  Pu 
isotope  can  be  dealt  with  separately:  thermal  denaturing'  with 
‘■'“Pu  above  and  neutronic  denaturing'  with  all  three  isotopes 
below.  Practicable  dilution  with  343Pu  cannot  alter  design  con¬ 
straints  enough  to  affect  the  conclusions  below. 

Finally,  nonmetqllic  forms  of  Pu  must  be  considered  Reactor - 
grade  Pu  can  be  used  directly  in  bombs  without  reduction  to 
metal  (though  metal  generally  gives  belter  performance).  The 
Oxygen  in  PuO;  dilutes  the  Pu  and  lengthens  the  generation 
time'  between  fissions,  reducing  the  yield,  but  it  also  slightly 
compensates  by  moderating  the  neutrons  to  lower  energies 
where  the  fission  cross-sections  are  higher  The  dilution  effect 
predominates  and  roughly  doubles43  the  cS-phase  metallic  It 
also  alters  other  design  parameters  Nonetheless,  the  oxy  gen  is 
not  a  neutron  poison  and  dives  not  present  attainment  of  "large 
reactivity  coefficients  and  short  neutron  life  times  "  '  even  in  the 
much  levs  reactive  'GO.  Indeed,  the  low  initial  density  (p  - 
2.3  g  cm  '  uncompacted.  4  5  g  cm  '  moderately  compacted)  of 
PuO  powder  relative  to  its  sintered  i--  1 1.21  or  crystal  1 1  1  5) 
density .  and  its  relative  compressibility  at  crystal  density,  permit 
crude  designs  with  a  generous  safety  margin  of  initial  suh- 
eriticalily  to  achieve  high  -  upercriticality  after  implosion  It  is, 
therefore,  not  surprising  that  PuO.  has  been  uniformly  agreed  to 
be  directly  useable  in  formidable  explosives'"  '"  4  ' 4I.  A  bomb 
made  directly  even  from  fresh  1  MFBR  mixed  oxide  fuel  (15 
25%  Pul  is  theoretically  possible4",  though  unwieldy 

Weapons  physics  and  reactor-grade 
plutonium 

A  nuclear  explosion  results  from  a  divergent  chain  reaction  in  a 
prompt-supercritical  mass,  that  is.  one  which  can  support  a 
chain  reai  lion  h\  virtue  onlv  of  the  prompt  neutrons  released 
immedtatek  In  fission  I  he  hs*  i*m  neurons  in  .1  Nmib  .ire  fast, 
with  etu  tews  in  the  meeavolt  1  mcc  and  \.el<\ in-'s  of  the  order  of 
I  3  4  ln\tns  1  he  Hsmo:u  V  -m.o  S  of  Mi’hwicui 
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size  and  density  that  a  neutron  born  within  it  is  likely  to  cause  a 
further  fission  within  it.  The  critical  masses  discussed  above 
imply  that  the  mean  distance  between  fissions  is  of  the  order  of 
centimetres,  hence  that  the  mean  time  between  fissions  is  of 
the  order  of  10'*  s.  Roughly  "40-50  generations  of  fissions  are 
required  to  build  up  a  fast  chain  reaction  to  an  explosive 
level"41:  e411  =  2.4  x  1017  fissions  would  release  1.6xI0’kcal. 
equal  to  the  nominal  energy  release  from  -1.6  kg  of  high 
explosive  and  thus  approaching  the  energy  density  needed  to 
disassemble  rapidly  a  Pu  core  of  nominal  size.  Only  the  last  few 
generations  in  this  exponential  process  provide  appreciable 
energy  yield  That  energy  builds  up,  in  a  few  hundredths  of  a 
microsecond,  temperatures  of  several  hundred  million  °C  and 
pressures  of  the  order  of  10“  bar,  causing  the  core  to  expand  with 
a  velocity  of  the  order  of  10*  cm  s  '.  Expansion  from  the  initial 
radius  by  a  factor  roughly  equal  to  the  sixth  root  of  the  number 
of  critical  masses  present,  that  is,  by  -  1  cm,  makes  the  mass 
subcritical  and  quenches  the  chain  reaction.  Once  the  explosion 
begins,  then,  only  a  few  more  generations  of  fission,  producing 
most  of  the  yield,  are  possible. 

The  designer  seeks  to  assemble  as  supercritical  a  mass  as 
possible  (by  inserting  reactivity’)  as  quickly  as  possible,  and 
to  inject  neutrons  to  initiate  the  chain  reaction  at  the  optimal 
moment  during  that  assembly — before  the  instant  of  maximum 
supercriticality,  so  that  the  bomb's  tendency  to  fly  apart  is  partly 
countered  by  the  continuing  forces  of  convergent  assembly.  The 
yield  of  the  nuclear  explosion  depends  strongly  on  the  degree  of 
supercriticality  achieved  when  the  chain  reaction  is  initiated.  If 
the  neutron  background  is  so  large  that  preinitiation,  before  the 
optimal  moment,  is  likely,  then  the  yield  varies'"  as  (rate  of 
reactivity  insertion)"1'1  \ 

Prcinitiation  reduces  yield  according  to  the  Poisson  statistics 
of  neutron  background,  and  can  be  counteracted  by  faster 
assembly  For  a  constant  level  of  maximum  reactivity  insertion, 
the  probability  of  avoiding  preinitiation  varies  as  1  /exp  ( neutron 
source  strength  x  assembly  timel. 

Preinitiation  is  a  problem  faced  by  any  nuclear  weapons 
designer  using  any  fissionable  material'1.  With  :3'U  (spon¬ 
taneous  fission  rate  8xl()  4  n  g  1  s  '),  it  is  a  mild  problem,  so 
assembly  by  the  relatively  slow  gun’  method  at  published  rates 
<  1  mm  p.s ' 1  (0.3  mm  ps'1  in  the  Hiroshima  bomb)  suffices.  But 
even  weapons-grade  Pu.  with  neutron  background  *60,000 
times  higher  (just  above  33“U),  preinitiates  unless  assembled 
implosively  by  a  convergent  arrangement  of  chemical  high 
explosives.  The  radial  compression  rate  can  then33  exceed 
2  mm  ps"1. 

A  reflected  core  of  Pu  metal,  sufficiently  subcritical  that 
neutron  multiplication  can  be  neglected,  will  have  a  neutron 
background  of  the  order  of  0.5  x  10*  n  s' 1  if  of  weapons  grade, 
several  million  ns'1  if  of  reactor  grade.  The  former  figure 
implies  a  mean  time  between  neutrons  of  a  few  microseconds — 
half  an  order  of  magnitude  longer  than  the  duration  of  the  fission 
chain.  But  the  latter  figure  implies  a  mean  time  between 
neutrons  that  is  short  compared  with  the  time  required  to 
complete  the  assembly  of  a  highly  supercritical  mass,  unless  that 
assembly  is  extremely  rapid,  implying  very  high  shock  velocities 
and  compression  This  can  in  fact  be  achieved 

Plutonium  of  any  feasible  grade  (weapons  or  reactor i  is 
unsuitable  for  the  gun-assembled  systems  because  the  neu¬ 
tron  background  and  relatively  long  assembly  time  intro¬ 
duces  significant  preinitiation  probabilities.  This  is  not 
necessarily  true  for  implosion  types"'4. 

Preinitiation,  then, 

.  .  does  not  necessarily  make  an  explosive  unreliable. 
Preinitialion  Joes  result  in  a  statistical  uncertainty  in  the 
yield  .  (that)  is  statistically  distributed  between  predict¬ 
able  upper  and  lower  limits  which  are  likely  to  be  more  than 
a  factor  of  10  apart.  For  a  Kell-understood  </ew ipi  properly 
confirm  ted.  however,  the  most  probable  yield  range  could 
be  predicted  within  much  closer  limits ”  1 
"In  implosion  devices,  preinitialion  probabilities  mav  be 
lowered  by  various  design  techniques  Even  relatively  low 


technology  designs,  notw  it hsta ruling  the  v  ar lability  in  yield, 
can  produce  effective,  highly  powerful  u capons""'4 
This  can  be  achieved41  even  with  a  neutron  source  strength  of 
the  order  of  10*  ns1.  As  was  officially  appreciated  in  1944, 

”.  .  .  [A]  rough  quantitative  analysis  of  the  assembly  velo¬ 
cities  attainable  with  very  large  charges  of  high  explosive 
suggested  that  because  of  the  strong  focusing  effect  of 
the  converging  material,  one  could  introduce  a  strong 
steady  source  of  neutrons  into  the  bomb  (for  example, 
by  deliberately  leaving  the  material  in  an  impure  state), 
and  still  beat  the  chain  reaction  and  attain  complete 
assembly". 

Thus  preinitiation  ",  .  .  may  mean  a  statistical  uncertainty  in 
the  yield  within  a  predictable  range.  Increasing  technological 
sophistication  will  reduce  this  uncertainty"’1. 

Now,  consider  several  several  levels  of  "increasing  techno¬ 
logical  sophistication"  and  their  likely  effects  on  the  perform¬ 
ance  of  implosion  bombs  made  from  reactor -grade  Pu  or  other 
compositions"  with  high  neutron  source  strength 

Performance  as  a  function  of  design 

Since  it  became  public  knowledge  that  construction  of  illicit 
nuclear  weapons  by  non-state  adversaries  must  be  taken 
seriously and  that  reactor-grade  Pu  is  suitable  for  such 
bombs”  :4,  the  level  of  technology  on  which  most  discussions 
have  centred  can  be  described  as  ’crude  amateur  designs’  in 
which  the  normal  military  design  requirements  for  pure  fissile 
material  and  for  the  symmetry,  simultaneity,  and  speed  of 
implosion  are  very  considerably  relaxed.  The  canonical 
description  of  such  designs  is  that  of  Willrich  and  Taylor”: 
"Under  conceivable  circumstances,  a  few  persons,  possibly 
even  one  person  working  alone,  who  possessed  -  10  kg  of 
plutonium  oxide  and  a  substantial  amount  of  chemical  high 
explosive  could,  within  several  weeks  [or  perhaps  less], 
design  and  build  a  crude  fission  bomb  .  .  [that]  would  have 
an  excellent  chance  of  exploding.  .  .  probably  . .  with  the 
power  of  at  least  1 00  tons  of  chemical  high  explosives.  This 
could  be  done  using  materials  and  equipment  that  could  be 
purchased  at  a  hardware  store  and  from  commercial 
suppliers  of  scientific  equipment  for  student 
laboratories.  .  .  .  [It]  might  yield  as  much  as  20  kilotons  of 
explosive  power — the  equal  of  the  Nagasaki  A-bomb 
[though  the  probability  of  such  a  high  yield  is  quite  small]." 
“...very  sophisticated  thermal-hydraulic  and  neutronic  cal¬ 
culations"43  would  not  be  needed.  Several  suitably  comprehen¬ 
sive  literature  searches  have  in  fact  been  conducted  by  amateurs. 
The  bomb  could  fit  in  a  car41. 

Making  an  effective,  transportable  fission  bomb  is  not  a  trivial 
task.  Safely  realising  a  paper  design  in  properly  working 
apparatus  would  require  alertness  to  subtleties  and  care  and  skill 
in  technical  arts  (which  many  criminal  enterprises  have  shown). 
The  necessary  human  resources  will  be  assumed  here  to  have 
been  obtained  The  skills  required  for  both  design  and  fabri¬ 
cation  naturally  increase  with  increasing  sophistication  and  have 
been  taken  into  account  in  the  policy  conclusions  drawn  here. 

Several  studies'3  41 "  have  dealt  quantitatively  with  the 
heterogeneous  class  of  flexible  and  imprecise  designs  grouped 
here  as  Level  One  technology.  C  alculations  confirm  that  in  the 
absence  of  gross  incompetence  or  malfunction  of  major 
components.  Level  One  technology  is  extremely  likely  to 
yield  >0.01  kton,  likely  to  yield  in  the  range  0.1  —  1  kton, 
able  on  occasion  to  yield  several  kton,  and  unlikely  to  yield 
10-20  kton 

A  second  level  of  technology  might  be  characterised  as 
imitation  Trinity  designs'  or  as  1945-vintage  US  technology  It 
uses  special  high-explosive  components  and  detonators  (all  of 
which  are  commercially  available  nn  a  straightforward  geometry 
to  compress  an  accuiitelv  made  metallic  Pu  core  Given  the 
materials  and  information  that  have  become  widely  available 
since  the  1 94iis.  such  a  tech  nolog  v  miglo  be  tvpual  of  a  low  level 
national  orfoit  to  produ.  e  a  bomb  til  it  can  be  depended  on  to 
milk  .v  ell  w  ithout  previous  V  im  I  r  m  I'  v  u.  Med  I  '  kton  i  It  is 
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not  a  clever  technology  (simpler  means  can  produce  better 
results)  but  is  basic  and  reliable,  and  has  been  the  subject  of 
several  amateur  design  exercises.  Five  distinguished  nuclear 
weapons  experts  concluded  that  using  weapons-grade  Pu  (or 
!,’U  or  highly  enriched  2,'U) 

"...  it  is  possible  to  design  low  technology  devices  that 
would  reliably  produce  explosive  yields  up  to  the  equis  alent 
of  10  or  20  kilotons  of  TNT  With  reactor- grade  plutonium  it 
is  possible  to  design  low-technology  devices  with  probable 
yields  3-10  times  lower  than  those  mentioned  above 
(depending  on  the  design),  but  yields  in  the  kiloton  range 
could  be  accomplished.  Militarily  useful  weapons  with 
reliable  nuclear  yields  in  the  kiloton  range  can  therefore  be 
constructed  using  low  technology  and  reactor-grade  plu¬ 
tonium"1*. 

(This  is  consistent  with  De  Volpis  Tabie  L-6  results’’,  given 
realistic  choices  of  parameters.)  As  for  the  resources  required, 
"a  small  group  of  people,  none  of  whom  have  ever  had  access  to 
the  classified  literature",  could  get  by  with  "modest  machine- 
shop  facilities  that  could  be  contracted  for  without  arousing 
suspicion"  and  with  "a  fraction"  (perhaps  a  small  fraction  i  of  a 
million  dollars  for  open-market  equipment14. 

Recently  declassified  documents  dealing  w  ith  1945  US  tech¬ 
nology  give1 

",  .  .  quite  precise  quantitative  information  .  .  covering 
some  aspects  of  how  the  probability  distribution  of  nuclear 
yields  changes  with  the  isotopic  composition  of  the  plu¬ 
tonium  used.  .  .  .  This  information  makes  clear  that  with 
power  reactor  grade  plutonium,  an  implosion  weapon  of 
even  the  simple  kind  first  used  by  the  US  would  reliably 
have  yields  between  1  and  20  kton"'2. 

Preinitiation  at  the  least  favourable  moment'"  in  a  Trinity-type 
bomb  would  still  produce'  reliable  kiloton  yields:  the  worst- 
case.  minimum,  fizzle'  yield  is  still  a  "militarily  useful"'1 
-  1  kton.  This  behaviour  is  chiefly  a  function  of  assembly  rat-, 
not  neutron  background,  because  the  least  favourable  moment 
cannot  get  any  less  favourable  The  same  conclusion  would 
therefore  hold*2  even  with  arbitrarily  high  neutron  source 
strength,  as  from  a  large  fraction'  of  2*2Pu  (ref.  46)  and  high 
1J“Pu  (ref.  37).  Contrary  to  Meyer  era/.*’,  "slight  mistakes  in  the 
knowledge  of  exact  isotopic  composition"  could  not  "lead  to 
neutralisation  of  the  explosive  design"  and  could  indeed  be 
readily  accommodated  by  design. 

Selden  summarises": 

"ft  is  likely  that  a  nuclear  explosive  designer  would  choose 
to  minimise  the  2i"Pu  concentration,  given  the  choice. 
However,  an  entirely  credible  national  nuclear  explosives 
capability  could  be  constructed  using  only  reactor  grade 
plutonium." 

Of  course,  the  designer  may  choose  to  avoid  the  extra  fiscal  and 
political  cost  (if  detected)  of  the  unambiguously  military  dedi¬ 
cated  facilities  required"  to  make  large  amounts  of  the  more 
conveniently  useable  weapons  grade  Pu  Some  governments 
may  find  advantages,  notably  civilian  cover',  in  doing  the  best 
they  can  with  their  plentiful  high-burn-up  Pu  instead  Recent 
classified  analyses  have  therefore  explored  further  levels  of 
technological  sophistication  that  can  overcome  the  sub-optimal 
features  of  high-burn-up  Pu  and  increase  the  -  1  -kton  minimum 
yield  of  Level  Two  technology 

Perhaps  the  most  categorical  statement  of  the  results  comes 
from  a  speech1*  by  Commissioner  Gilinsky  (emphasis  added): 
"...  |S|o  far  as  reactor- grade  plutonium  is  concerned,  the 
fact  is  that  it  is  possible  to  use  this  material  for  nuclear 
warheads  at  all  levels  of  technical  sophistication  In  other 
words,  countries  less  advanced  than  the  major  industrial 
powers  but  nevertheless  possessing  nuclear  power  pro¬ 
grams  can  make  very  respectable  weapons  And.  I  might 
add.  these  are  the  very  countries  whose  names  turn  up  in 
every  discussion  of  proliferation.  Of  course,  when  reactor 
grade  plutonium  is  used  there  may  he  a  penalty  in  per 
formance  that  is  considerable  ■  t  insignijnant.  depending  on 
the  weapon  design  But  whatever  we  might  mice  have 


thought,  we  now  know  that  even  simple  [Level  Two] 
designs,  albeit  with  some  uncertainties  in  yield,  can  serve  as 
effective,  highly  powerful  weapons — reliably  in  the  kiloton 
range." 

The  italicised  passages  imply  that  further  levels  of  technology 
exist  with  still  higher  yield  and  predictability  than  Level  Two. 

A  third  lev  el  of  technology  seeks  to  overcome  preinitiation  by 
extremely  rapid  assembly.  The  necessary  rates  of  assembly  can 
be  calculated  and  seem  to  be  readily  attainable.  One  published 
configuration,  for  example,  is  stated  to  be  able  to  compress  a 
sizeable  core  at  several  times  the  2mmp.s"  radial  rate 
mentioned  earlier.  Far  higher  rates  are  possible  with  this 
method,  because  in  a  convergent  implosive  system,  shock  pres¬ 
sures  vary  roughly  as  the  inverse  fourth  power  of  radius  and 
shock  velocities  as  the  inverse  square  of  radius  Applying  the 
same  design  to  a  small  core  can  therefore  achieve  such  high 
assembly  velocities  that  the  shock  can  traverse  much  of  the  core 
and  insert  very  substantial  reactivity  before  hydrodynamic  dis¬ 
assembly  forces  can  dominate  The  probability  of  preinitiation 
then  becomes  small,  the  expected  yield  relatively  large,  and  its 
dispersion  small  in  short,  the  performance  penalty  approaches 
the  "insignificant "'*. 

Calculations  suggest  that  this  Level  Three  technology  is 
sufficient,  using  reactor-grade  Pu,  for  almost  any  military 
objective,  even  with  attempted  denaturing'”.  The  method  will 
readily  occur  to  most  governments  and  to  many  technically 
informed  amateurs.  The  apparatus  is  not  unduly  difficult  to 
achieve.  It  does  not  necessarily  involve  a  higher  technology  than 
Level  Two,  and  should  be  considered  more  a  logical  extension  of 
Level  One.  a  smart  amateur  design',  than  the  exclusive  province 
of  governments.  It  does  not  necessarily  require  nuclear  testing  to 
ensure  confidence  in  obtaining  high  yield,  provided  the  maker  is 
confident  that  the  well-characterised  non-nuclear  components 
will  function  as  designed  Non-nuclear  test  firings  would,  of 
course,  increase  this  confidence 
Most  military  bombs  are  required  to  function  normally  in  high 
neutron  fluxes  such  as  might  arise  from  nearby  nuclear 
explosions.  Essentially  the  same  design  considerations  apply  as 
in  the  case  of  high  internal  neutron  source  strengths.  It  can  be 
safely  presumed  that  these  problems  are  routinely  overcome  by 
various  means,  including  thermonuclear  techniques  that  could 
render  the  penalty  from  using  reactor-grade  Pu  not  inly  very 
small  but  nil.  even  at  very  high  yields  This  is  a  very  hign 
technology  requiring  elaborate  theoretical,  computational,  and 
fabrication  facilities,  together  with  prior  nuclear  testing  But 
such  sophistication  is  not  required  lor  governments  or  even  for 
some  subnational  groups  to  extract  from  reactor-grade  Pu,  using 
Level  Three  technology,  the  kind  of  yield  and  predictability  that 
the  major  nuclear  powers  would  have  found  satisfactory  for 
inclusion  in  their  arsenals  around  the  early  1960s 

Weapons  effects  and  the  implications  of 
uncertain  yield 

Fissioning  I  kg  of  Pu  y  ields  (25  x  1 0  1  fissions!  *  I  -  1  SO  Me  V  of 
prompt  energy  per  fission'  -  7.3  x  10"  J  kg  1  or  -Px 
10"  gcal  kg"'  5=  17  kton  kg  '.  This  17-kton  yield  (Hiroshima 
was  13  kton,  Nagasaki  22  ktoni  corresponds  to  the  conversion 
of  a  mass  defect  of  only  0.8  g  But  unlike  chemical  high 
explosives,  some  of  the  yield  of  nuclear  explosives  appears  not  as 
blast  or  heat  but  as  prompt  electromagnetic  radiation  at  many 
frequencies,  especially  y  rays,  and  as  prompt  neutrons.  The 
smaller  the  nuclear  yield,  the  more  the  effects  of  the  nuclear 
explosion  are  dominated  by  prompt  radiation 

For  example,  a  crude  amateur  design'  yielding  only 
0.1  k tori  which  corresponds  to  fissioning  only  fi  g  la  nominal 
efficiency  of  the  order  of  It)  ')  and  converting  a  mass  defect  of 
5  mg  typically  produces"*"  500  rem  of  prompt  y  dose 
(roughly  the  1  D*.,.  or  dose  likelv  to  kill  half  those  exposed  to  iti 
at  unshielded  ranges  up  to  3nilni.  plus  500  rent  of  prompt 
neutrons  i  -  1  IV  i  to  4sn  ni.  plus  'Oil  'em  of  fallout  exposuic 
i  ll)  i  to  -ini  I  .(inn  m  for  people  lingering  foi  an  hum  5  el 
such  a  surf.ue  hut't  makes  a  ctalei  only  14  ni  in  ratlins  Blast 
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damage  is  also  of  shorter  range  than  the  prompt  radiation — 
severe  (overpressure  to  10  lb  in'2  =  0.68  bar)  to  150  m  and 
moderate  13  lb  in  2  =  0.20  bar)  to  300  m.  The  relatively  limited 
blast  damage,  even  at  such  low  yield,  however,  could  amplify  the 
radiation  effects  by  -10J  times  if  used  to  induce  a  1%  ground 
release  from  an  operating  1-GWe  LWR  (16-GCi  inventory), 
—  10-100  times  more  from  a  reprocessing  plant. 

Effects  of  larger  yields  are  readily,  if  roughly,  calculable  from 
standard  scaling  laws”  ”,  For  example,  a  yield  of  i  kton,  a 
practical  minimum  with  Level  Two  technology  (but  three  orders 
of  magnitude  larger  than  a  World  War  II  blockbuster),  would 
devastate  several  km2,  with  500  rem  prompt  radiation  beyond 
700  m  and  with  500  rem  fallout  around  1-3  km.  If  a  yield  Y 
expected  to  be  8  kton  is  in  fact  only  1  kton,  the  blast  area  will 
diminish  not  by  7/8  but  by  3/4  (as  V2'3),  and  the  lethally 
irradiated  area  only  by  half  (as  V1'3)  (refs  1,  53).  Such  reduc¬ 
tions  would  generally  be  smaller  than  the  variability  in  effect 
expected  from  the  varying  circumstances  of  use;  and  except  in 
special  tactical-warfare  conditions,  the  important  thing  is  not 
whether  the  designer  can  predict  the  exact  yield,  but  rather  that 
the  potential  victim  cannot. 


Conclusions 

The  above  discussion  has  sought  to  provide  a  discreet,  selective, 
but  adequate  physical  basis  for  understanding  the  scope  for 
using  reactor-grade  Pu  in  fission  bombs  at  some  of  the  diverse 
levels  of  sophistication  open  to  various  potential  users  (the 
taxonomy  given  is  not  exhaus 
it.  singly  or  in  combination, 
emitting  diluents  such  as  2 
55) — or  indeed  any  other  interfering  material  that  cannot  be 
readily  removed,  for  example,  by  ion  exchange — is  "fallacious" 
and  "not  a  valid  concept"”.  (Dilution  with  UO;  or  other 
materials  requiring  chemical  or  physical’4  separation  is  a  valid 
concept— it  means  more  material  must  be  diverted  and  pro¬ 
cessed”  25  u— but  does  not  solve  the  problem.)  Taking  all  effects 
on  weapons  physics  into  account,  a  high  2'" 2411 242Pu  content 
may  reduce  expected  yield  to  a  level  that  could  devastate  only  a 
reduce  expected  yield  to  a  level  that  could  devastate  only  a 
modest  portion  of  a  city  rather  than  all  of  it,  and  may  make  that 
yield  much  less  predictable,  if  the  bomb  is  crudely  made.  But 
these  faults  can  be  overcome  by  more  clever  design,  without 
necessarily  using  high  technology,  and  at  Level  Three  this  can  be 
done  by  gifted  amateurs.  It  is  therefore  incorrect  to  state  cate-1 
gorically  that  bombs  made  from  reactor-grade  or  deliberately 
"denatured'”  Pu  are  less  effective,  less  powerful,  or  less  reliable 
than  those  made  from  weapons-grade  Pu.  Whether  these  reser¬ 
vations  hold,  and  whether  by  a  meaningful  margin,  depend  on 
the  designer's  intentions,  skills,  and  resources,  all  of  which  may 
be  unknowable.  And  the  implication  that  the  effects  of  even  a 
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crude,  minimal  0.1-1  kton  explosion  would  be  tolerable  for  a 
free  society  ts  at  best  disingenuous1®"21 21. 

The  foregoing  argument  also  implies  that  power  reactors  are 
not  an  implausible  but  are  rather  potentially  a  peculiarly  con¬ 
venient  type  of  large-scale  military  Pu  production  reactor.  This 
goes  beyond  the  proposition  that 
", . .  in  situations  of  extreme  tension  states  may  turn  to 
second  or  third  best  instruments  to  get  their  hands  on 
weapons  they  regard  as  essential  to  their  security.  The  point 
is  that,  with  plutonium  readily  available,  it  may  be  turned 
to.  And  those  groups  within  countries  that  want  to  go 
nuclear  can  pursue  an  ambiguous  path  of  keeping  their 
options  open  until  the  last  minute  under  a  commercial 
disguise"”. 

A  government  can  either  manipulate  civil  fuel  cycles  to  produce 
substantial  amounts  of  low-burn-up  plutonium,  or,  especially 
using  Level  Three  technology,  use  high-burn-up  Pu  in  bombs 
with  insignificant  performance  penalty.  Regardless  of  possible 
technical  measures24"2”4511’®,  such  Pu  will  become  readily 
available  in  quantities  of  the  order  of  104-105  mc  yr'1,  and  in 
extracted  forms  useable  for  weapons  within  hours  or  days,  if 
plans  proceed  for  commercial  reprocessing,  which  is  unsafe- 
guardable  both  today3*  and  in  principle14  5®*0.  Making  even 
high-burn-up  Pu  in  domestic  power  reactors  incurs  no  penalty  in 
reactor  efficiency  or  in  equipment  costs:  a  reactor-exporting 
country  will  gladly  build  the  reactor,  train  the  technicians,  and 
pay  for  the  whole  package  with  generous  export  subsidies.  If 
extracted,  and  using  any  of  the  numerous  means  of  evading 
effective  safeguards,  the  Pu  discharged  from  a  single  large  power 
reactor  suffices  for  about  102  bombs  per  year,  a  large  weapons 
programme,  and  there  is  the  alternative  of  embezzling  up  to  a 
few  bombs'  worth  per  reactor-year  from  the  fuel  cycle  within  its 
-  1  %  statistical  'noise',  a  form  of  theft  that  can  be  made 
undetectable  in  principle.  The  marginal  time  and  money 
required  to  use  civil  reactors  for  military  production  are  orders 
of  magnitude  less21  than  those  needed  for  dedicated  military 
facilities"  *1.  The  extra  facilities  and  staff  required  could  be 
hidden  within  the  civil  programme:  the  "  ideal  place  to  hide  a 
tree  is  in  a  forest"*1.  And  perhaps  the  greatest  attraction  of 
producing  military  Pu  in  a  power  reactor  is  that  it  has  a  civilian 
'cover'  and  thus— at  least  until  regional  rivals  follow  suit— an 
apparently  zero  political  cost. 

In  short,  the  somewhat  greater  technical  difficulty  of  using 
power-reactor  Pu  for  effective  military  bombs — assuming  the 
reactor  is  actually  operated  at  high  fuel  burn-up — may  be  more 
than  counterbalanced  by  the  greater  political  and  economic  ease 
of  obtaining  that  Pu.  It  "should  not  be  lightly  disdained  in  favour 
of  purer  material  from  dedicated  facilities"*1. 
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APPENDIX  C:  THE  SEMANTICS  OF  "DECENTRALIZATION" 


So  common  is  the  doctrinaire  assumption  that  energy  systems  must  be  big  in 
order  to  be  affordable  that  anyone  interested  in  assessing  the  merits  of  energy 
technologies  of  appropriate  scale  is  often  presumed  to  be  equally  doctrinaire 
in  a  "small  is  beautiful"  direction.  In  fact,  the  late  E.F.  Schumacher  often 
emphasized  that  it  is  just  as  wrong  to  be  addicted  to  universally  small  as  to 
universally  large  scale:  what  matters  is  a  scale  appropriate  for  each  task. 

What  is  appropriate  depends  not  only  on  economics  and  logistics  (Chapter  5)  but 
also  on  sociopolitical  issues.  Those  are  beyond  the  scope  of  this  discussion 
[Lovins  1977]  but  figure  prominently  in  the  wider  literature  of  scale. 

Another  problem  with  discussing  the  full  spectrum  of  technological  scale 
is  that  to  many  people,  "small"  and  "decentralized"  are  interchangeable  terms. 
But  the  large  and  growing  literature  dealing  with  appropriate  technology,  al¬ 
ternative  development  concepts,  and  "post-industrial"  production,  settlement, 
and  political  patterns  is  often  imprecise  in  defining  "decentralized."  The 
term  is  in  any  case,  as  Langdon  Winner  remarks,  a  "linguistic  trainwreck";  and 
besides  being  oxymoronic,  it  is  ambiguous.  To  avoid  confusion,  we  confine  this 
discussion  to  the  energy  system  (not  to  industrial,  urban,  or  governmental 
patterns),  where  we  identify  eight  possible  dimensions  of  "decentral izat ion": 

-  Unit  scale.  If  "unit"  means  a  device  which  converts  and  supplies 
energy,  there  is  little  ambiguity:  a  unit  supplies  energy  in  some  form  at  a 
rate  of  so  many  watts  in  a  particular  time  pattern,  depending  on  specified 
parameters.  We  shall  use  "scale"  in  this  sense  of  unit  size  or  output  capacity. 

-  Dispersion .  This  refers  to  spatial  density — whether  individual  units 
are  clustered  or  scattered,  concentrated  or  distributed,  relative  to  each 
other.  It  does  not  specify  unit  scale  or  the  nature  of  any  interconnections. 

-  Interconnectedness .  Separate  units  can  be  coupled  to  each  other,  stand¬ 
alone  (connected  only  to  the  end-user),  or  both  optionally.  Interconnect  ion 
may  increase  reliability,  and  certainly  allows  a  given  amount  of  supply  capa¬ 
city  to  meet  a  somewhat  larger  amount  of  diverse  demand  because  not  all  demands 
are  simultaneous.  Interconnectedness  says  nothing  about  unit  scale,  dispersion, 
or  distance  from  the  user.  It  may  refer  to  electricity  or  to  other  forms  of 
energy  (e.g.  solar  collectors  connected  by  a  district-heating  grid).  Intercon¬ 
nections  can  span  a  wide  range  of  technical  and  topological  complexity. 

-  Compos  it  ion .  Different  units  can  be  monolithic  (consisting  of  insepar¬ 
able  parts)  or  modular  (combining  multiple  subunits).  A  gas-turbine  power 
plant,  windfarm,  or  photovoltaic  array  is  generally  modular;  a  central  thermal 
plant  is  more  monolithic.  Proposed  "nuclear  parks"  would  be  modular  but  their 
modules  would  be  individually  enormous:  composition  does  not  specify  unit  size. 
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-  Central i zat i on .  This  is  not  a  technical  property  of  a  unit  in  isola¬ 
tion,  but  rather  expresses  its  users'  perception  of  its  physical  and  social 
relationship  to  them.  A  centralized  unit  serves  its  users  via  a  distribution 
system  which  makes  the  users  feel  relatively  remote,  geographically  or  politi¬ 
cally  or  both,  from  that  unit.  A  decentralized  unit  is  more  local,  with  short 
supply  lines.  A  large  hydroelectric  dam  serving  several  large  smelters  nearby 
may  seem  local  and  decentralized  to  their  operators;  decentralized  can  be  big 
if  the  use  is  correspondingly  big.  A  "windfarm"  of  many  small  wind  machines  at 
the  other  end  of  a  long  transmission  line,  or  many  solar  collectors  whose  heat 
is  distributed  via  an  extensive  network  institutionally  similar  to  present  gas 
and  electric  grids,  can  look  centralized  to  its  users;  thus  a  collection  of 
small  units  can  be  centralized*.  An  assemblage  of  many  solar  concentrat ing 
dishes  may  be  decentralized  if  dispersed  near  scattered  users,  or  decentralized 
if  clustered  near  clustered  users.  Decentralized  does  not  necessarily  mean 
renewable  (cf.  dispersed,  locally  used  natural-gas  wells  or  even — in  some 
Swedish  proposals — nuclear  heat  reactors).  Conversely,  renewable  systems  can 
be  centralized,  as  in  "power  tower,"  ocean-thermal-electric,  biomass-planta¬ 
tion,  solar-power-satellite,  and  similar  schemes — although  it  is  not  obvious 
why  one  should  wish  to  gather  up  an  inherently  dispersed  energy  flux  (e.g.  sun¬ 
light)  into  one  place  in  order  to  be  put  to  the  expense  of  distributing  it 
again  to  dispersed  users.  Decentralization  is  a  property  intermediate  between 
the  purely  technical  qualities  described  above  and  the  more  sociologically 
oriented  ones  listed  below. 

-  User-controllability.  Many  energy  users  are  concerned  with  the  extent 
to  which  they  can  choose  and  control  the  energy  systems  important  to  their 
lives.  This  concern  extends  both  to  immediate  decisions  about  end-use  patterns 
— for  example,  being  able  to  turn  a  light  on  and  off  at  one's  own  convenience 
preserves  individual  autonomy — and  to  the  wider  question  of  the  political 
process  by  which  decisions  about  the  energy  system  are  made:  whether  they  are 
participatory  and  pluralistic  or  dominated  by  a  central  technical  elite. 

-  Comprehensibil ity.  Whether  a  technology  is  arcane  or  understandable  is 
important  to  accountability.  A  system  can  be  understandable  to  its  user  even 
if  it  is  technically  very  sophisticated.  Most  people  could  not  build  a  pocket 
calculator  and  do  not  know  exactly  what  goes  on  inside  it,  but  for  them  as  us¬ 
ers  it  is  a  tool  rather  than  a  machine:  they  run  it,  not  the  other  way  around. 

-  Dependency.  The  "poles"  of  this  spectrum  of  economic,  political,  and 
psychological  relat ionsh i ps  might  be  multinational  corporations  on  the  one  hand 


*In  principle,  a  single  small  unit  could  be  "centralized  away  from"  its  user 
(note  the  paradoxical  flavor  of  this  phrase)  by  putting  it  at  the  end  of  a  long 
transmission  line,  but  in  practice  this  would  generally  be  irrational. 
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and  do-it-yourself,  appropriate,  or  (in  Ivan  Illich's  phrase)  "vernacular" 


technologies  on  the  other — things  that  people  can  do  for  themselves.  Dependen¬ 
cy  expresses  energy  users'  feeling  that  their  own  interests  are  not  identical 
with  those  of  energy  providers.  A  high  degree  of  dependency  might  be  charac¬ 
teristic  of:  a  "black  box"  energy  source  which  is  designed,  made,  and  installed 
by  some  remote  and  unaccountable  institution;  a  source  which  a  user  is  humilia¬ 
tingly  unable  to  understand,  repair,  adjust,  or  modify;  or  a  source  whose  pres¬ 
ence  or  price  are  beyond  users'  control.  Supplying  energy  oneself  or  through 
more  familiar  (hence  usually  more  local)  institutions  would  incur  a  low  degree 
of  dependency.  Dependency  is  related  also  to  breadth  of  choice:  buying  fuel 
from  one  of  a  number  of  competitive  local  distributors  offers  choice  in  a 
narrow  sense,  but  may  still  create  a  feeling  of  dependency  if  all  the  fuels  are 
ultimately  derived  from  identical  or  similar  institutions. 

The  political  context  in  which  energy  users  perceive  their  supplies  might 
be  thought  of  as  a  sequence  of  operations:  devices  and  supplies  are  produced  by 
an  industrial  system;  a  marketing  process  delivers  these  outputs  to  be  used  by 
energy  conversion  systems;  these  procure  and  convert  energy  into  useful  forms; 
and  an  energy  distribution  system  (which  could  vary  in  length  from  inches  to 
halfway  around  the  world)  then  provides  an  energy  service,  generally  via  an 
end-use  device,  to  the  final  user.  We  are  not  concerned  here  with  the  first 
two  steps  in  this  process  (save  as  their  structure  contributes  to  users'  per¬ 
ceptions  of  dependency,  controllability,  and  accountability).  The  qualities  of 
unit  scale,  dispersion  (density),  and  composition  refer  to  the  energy  conver¬ 
sion  systems;  interconnectedness  and  comprehensibility  refer  to  those  conver¬ 
sion  systems  and  to  their  associated  distribution  networks;  and  decentral iza- 
t ion  refers  to  the  physical  and  political  relationship  of  the  conversion 
systems  via  the  distribution  networks  to  the  users. 

Although  we  have  characterized  some  of  these  qualities  by  their  polar 
extremes,  each  has  a  continuum  of  values  in  a  spectrum.  Those  values  are 
relative  to  each  other  and  to  a  particular  context  of  use.  An  energy  system 
which  is  small  for  running  smelters  is  large  for  running  televisions.  One 
which  is  distributed  across  a  country  may  nonetheless  be  clustered  at  each 
point  of  occurrence.  One  which  is  comprehens ible  to  farmers  may  be  mysterious 
to  physicists  and  vice  versa.  One  which  is  decentralized  in  the  city  may  be 
centralized  in  the  countryside  (and  possibly  vice  versa)*.  Accordingly,  even 
where  a  specific  meaning  can  be  inferred  from  context,  it  is  important  to 
remember  that  all  the  qualities  described  are  relative,  not  absolute. 

♦Recall  that  in  our  sense,  "decentralized"  energy  systems  are  user-centered, 
i.e.  near  the  user,  while  "central ized"  ones  are  far  away.  No  wonder  these 
terms  have  given  rise  to  such  confusion! 
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